@bongos/core 1.19.425 → 1.19.427

package/tests/profile_connections_ui.mjs

@@ -0,0 +1,874 @@
+// tests/profile_connections_ui.mjs — the profile page's connections section
+// (R20, task 1002296 / goal 1000045 criterion C6; ADR 0202, ADR 0207).
+//
+// The whole stack, end to end, with nothing mocked in the middle: an in-memory
+// accounts + connections table whose filter is built FROM EACH STATEMENT'S OWN
+// WHERE clause, the REAL modules/platform-identity/routes/connections.js above
+// it on a REAL loopback HTTP server, and the REAL
+// modules/hall-ui/public/profile-connections.js above THAT in a DOM stub,
+// talking to the server through a real socket. So every assertion below is a
+// fact about what a browser would paint, not about a canned response.
+//
+// WHAT IT PINS, and why each is a rule rather than a behaviour:
+//
+//   1. `degree: null` RENDERS AS "OUT OF NETWORK", NEVER "NOT CONNECTED"
+//      (ADR 0202 Consequences). Past the caps or past three hops the query
+//      stopped searching; painting that as an absence of a relationship states
+//      something it never established. And the copy is BYTE-IDENTICAL whether
+//      the answer was truncated or not — the target's truncation is
+//      deliberately unreported (ADR 0207 L2), so copy that varied with
+//      `truncated` would rebuild that side channel in words.
+//
+//   2. A PRIVATE ACCOUNT IS ADDRESSABLE TO THE PEOPLE IT CONNECTED WITH AND TO
+//      NOBODY ELSE (ADR 0202 D4 §2). The same handle answers a degree label to
+//      one session and 404 to another, and on the 404 the section renders
+//      NOTHING — no label, no button, not even the handle.
+//
+//   3. THE CONNECT BUTTON CLAIMS EXACTLY `201 { status: 'pending' }` AND NO
+//      MORE (ADR 0207 D6). Including the case that matters: a re-ask swallowed
+//      by the 90-day decline cooldown answers identically, and when the page is
+//      loaded again the button is simply back to "Connect" with no explanation
+//      anywhere — because the API deliberately has none to give (ADR 0207 L1).
+//
+//   4. EVERY COUNT IS THE LENGTH OF THE LIST BESIDE IT, never a total the
+//      response carried (ADR 0171 D4 / ADR 0202 D4) — proved by handing the
+//      client a response whose `mutual_count` lies.
+//
+//   5. `seen_at` AND `truncated` NEVER REACH THE SCREEN.
+//
+// DB-free by construction — no Postgres, no network beyond loopback. The last
+// test proves this file runs in the lane that actually executes on a PR; three
+// tests once declared a lane they were in neither of and asserted nothing for
+// months (task 1002806 / learning 1000218).
+//
+// Run:  node --test tests/profile_connections_ui.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import vm from 'node:vm';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const CLIENT_SRC = readFileSync(join(ROOT, 'modules/hall-ui/public/profile-connections.js'), 'utf8');
+const PROFILE_JS = readFileSync(join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
+const PROFILE_HTML = readFileSync(join(ROOT, 'modules/hall-ui/public/profile.html'), 'utf8');
+
+const DAY = 24 * 60 * 60 * 1000;
+
+// The cast. ME is the session; every other account exists to make one rule
+// observable from the outside.
+const ME = 4242;    // the viewer
+const ADA = 9001;   // connected to ME            → 1st
+const BO = 9002;    // connected to ADA           → 2nd (renamed: handle 'bo', was 'bo-was')
+const CY = 9003;    // connected to BO            → 3rd
+const ZED = 9004;   // connected to nobody        → null, "out of network"
+const VIC = 9005;   // private, no edge with ME   → not addressable at all
+const PROV = 9006;  // provisional                → not addressable at all
+const SEC = 9007;   // private AND connected to ME → addressable to ME only
+const NEW = 9008;   // never asked                → the Connect button's home
+const COOL = 9009;  // declined ME 10 days ago    → the swallowed re-ask
+const OUTSIDER = 7777; // a second session, to prove "and to nobody else"
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+let accounts = [];
+let edges = [];
+let nextEdgeId = 1;
+
+const acct = (githubId, handle, name, over = {}) => ({
+  id: githubId, github_id: String(githubId), github_login: handle, display_name: name,
+  avatar_url: null, profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  recruiter_discoverable: null, handle, previous_handle: null, handle_changed_at: null,
+  bio: null, links: null, display_name_source: 'github',
+  created_at: new Date(0).toISOString(), updated_at: new Date(0).toISOString(), ...over,
+});
+
+function edge(a, b, status, over = {}) {
+  const now = Date.now();
+  const row = {
+    id: nextEdgeId++, requester_github_id: a, addressee_github_id: b, status,
+    note: null, seen_at: null, created_at: now - DAY, resolved_at: status === 'pending' ? null : now - DAY,
+    ...over,
+  };
+  edges.push(row);
+  return row;
+}
+
+function seed() {
+  accounts = [
+    acct(ME, 'octo', 'Octo'),
+    acct(ADA, 'ada', 'Ada Lovelace'),
+    acct(BO, 'bo', 'Bo', { github_login: 'bo-was', previous_handle: 'bo-was' }),
+    acct(CY, 'cy', 'Cy'),
+    acct(ZED, 'zed', 'Zed'),
+    acct(VIC, 'vic', 'Vic', { account_visibility: 'private' }),
+    acct(PROV, 'prov', 'Prov', { profile_state: 'provisional' }),
+    acct(SEC, 'sec', 'Sec', { account_visibility: 'private' }),
+    acct(NEW, 'newbie', 'Newbie'),
+    acct(COOL, 'cooled', 'Cooled'),
+    acct(OUTSIDER, 'outsider', 'Outsider'),
+  ];
+  edges = [];
+  nextEdgeId = 1;
+  edge(ME, ADA, 'accepted');
+  edge(ADA, BO, 'accepted');
+  edge(BO, CY, 'accepted');
+  edge(ME, SEC, 'accepted');
+  edge(VIC, BO, 'accepted');
+  // COOL declined ME 10 days ago — inside the 90-day cooldown, so a re-ask is
+  // swallowed and must be indistinguishable from a real one.
+  edge(ME, COOL, 'rejected', { resolved_at: Date.now() - 10 * DAY });
+}
+
+const findAccount = (gid) => accounts.find((a) => String(a.github_id) === String(gid)) || null;
+
+/**
+ * Build a connections-row filter from a statement's own WHERE text. Every
+ * placeholder the clause mentions must be consumed by a fragment below; one
+ * that is not throws, so a predicate this cannot read can never quietly
+ * degrade into "no constraint". (The tests/connections_ownership.mjs pattern.)
+ */
+function predicateFor(rawWhere, params) {
+  let where = rawWhere;
+  const tests = [];
+  const consumed = new Set();
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+
+  // The either-side clause is matched and STRIPPED first, so the single-column
+  // matchers below cannot re-read half of it as a one-sided filter.
+  let m = /\(requester_github_id = \$(\d+)::bigint OR addressee_github_id = \$(\d+)::bigint\)/.exec(where);
+  if (m) {
+    const a = p(m[1]); const b = p(m[2]);
+    tests.push((r) => String(r.requester_github_id) === String(a) || String(r.addressee_github_id) === String(b));
+    where = where.replace(m[0], ' TRUE ');
+  }
+  // The unordered pair, likewise stripped before the one-sided matchers.
+  m = /pair_lo = LEAST\(\$(\d+)::bigint, \$(\d+)::bigint\)\s*AND\s*(?:c\.)?pair_hi = GREATEST\(\$(\d+)::bigint, \$(\d+)::bigint\)/.exec(where);
+  if (m) {
+    const a = p(m[1]); const b = p(m[2]); p(m[3]); p(m[4]);
+    const lo = Math.min(Number(a), Number(b)); const hi = Math.max(Number(a), Number(b));
+    tests.push((r) => Math.min(r.requester_github_id, r.addressee_github_id) === lo
+      && Math.max(r.requester_github_id, r.addressee_github_id) === hi);
+    where = where.replace(m[0], ' TRUE ');
+  }
+
+  if ((m = /\bid = ANY\(\$(\d+)::bigint\[\]\)/.exec(where))) {
+    const ids = p(m[1]).map(String);
+    tests.push((r) => ids.includes(String(r.id)));
+  }
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
+  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
+  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
+  if (/\bseen_at IS NULL\b/.test(where)) tests.push((r) => !r.seen_at);
+  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
+  if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1]));
+    tests.push((r) => r.created_at > Date.now() - days * DAY);
+  }
+  if ((m = /created_at <= now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1]));
+    tests.push((r) => r.created_at <= Date.now() - days * DAY);
+  }
+  if ((m = /resolved_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1]));
+    tests.push((r) => r.resolved_at != null && r.resolved_at > Date.now() - days * DAY);
+  }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The account-side floors, read OUT OF the statement rather than assumed. A
+// read that stopped joining one of them stops matching here and throws, which
+// is the point: the pool must not be more permissive than the SQL.
+function accountFloor(sql, { alias = 'pa', axis }) {
+  const visible = `(${alias}.profile_state = 'active' AND ${alias}.account_visibility = 'public')`;
+  const active = `(${alias}.profile_state = 'active')`;
+  if (axis === 'visible') {
+    if (!sql.includes(visible)) throw new Error(`fake pool: expected the public visibility floor ${visible} in — ${sql}`);
+    return (a) => !!a && a.profile_state === 'active' && a.account_visibility === 'public';
+  }
+  if (!sql.includes(active)) throw new Error(`fake pool: expected the consent floor ${active} in — ${sql}`);
+  return (a) => !!a && a.profile_state === 'active';
+}
+
+const iso = (ms) => (ms == null ? null : new Date(ms).toISOString());
+const counterparty = (gid) => {
+  const a = findAccount(gid);
+  return { handle: a.handle, display_name: a.display_name, avatar_url: a.avatar_url };
+};
+
+// The accepted 1-hop of one account, as the union in neighboursSql reads it.
+const neighbours = (gid) => edges
+  .filter((r) => r.status === 'accepted' && (String(r.requester_github_id) === String(gid) || String(r.addressee_github_id) === String(gid)))
+  .map((r) => (String(r.requester_github_id) === String(gid) ? r.addressee_github_id : r.requester_github_id));
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+
+    // ---- accounts ---------------------------------------------------------
+    if (/FROM platform_identity_accounts WHERE github_id = \$1$/.test(sql)) {
+      const a = findAccount(params[0]);
+      return { rows: a ? [{ ...a }] : [], rowCount: a ? 1 : 0 };
+    }
+    if (/FROM platform_identity_accounts WHERE lower\(handle\) = \$1 OR lower\(previous_handle\) = \$1/.test(sql)) {
+      const want = String(params[0]);
+      const hit = accounts
+        .filter((a) => String(a.handle).toLowerCase() === want || String(a.previous_handle).toLowerCase() === want)
+        .sort((x, y) => Number(String(y.handle).toLowerCase() === want) - Number(String(x.handle).toLowerCase() === want));
+      return { rows: hit.slice(0, 1).map((a) => ({
+        github_id: a.github_id, handle: a.handle, display_name: a.display_name,
+        avatar_url: a.avatar_url, profile_state: a.profile_state, account_visibility: a.account_visibility,
+      })), rowCount: Math.min(hit.length, 1) };
+    }
+
+    // ---- is this pair already connected? ----------------------------------
+    if (/^SELECT 1 FROM platform_identity_connections WHERE/.test(sql)) {
+      const where = /WHERE (.+?) LIMIT 1$/.exec(sql)[1];
+      const hit = edges.filter(predicateFor(where, params));
+      return { rows: hit.slice(0, 1).map(() => ({ '?column?': 1 })), rowCount: Math.min(hit.length, 1) };
+    }
+
+    // ---- my accepted connections -----------------------------------------
+    if (/^WITH edge AS \(/.test(sql)) {
+      const floor = accountFloor(sql, { axis: 'active' });
+      const gid = params[0]; const limit = Number(params[1]); const offset = Number(params[2]);
+      const mine = edges
+        .filter((r) => r.status === 'accepted'
+          && (String(r.requester_github_id) === String(gid) || String(r.addressee_github_id) === String(gid)))
+        .map((r) => ({ id: r.id, gid: String(r.requester_github_id) === String(gid) ? r.addressee_github_id : r.requester_github_id, resolved_at: r.resolved_at }))
+        .filter((e) => floor(findAccount(e.gid)))
+        .sort((a, b) => (b.resolved_at || 0) - (a.resolved_at || 0) || b.id - a.id)
+        .slice(offset, offset + limit);
+      return { rows: mine.map((e) => ({ id: String(e.id), connected_at: iso(e.resolved_at), ...counterparty(e.gid) })), rowCount: mine.length };
+    }
+
+    // ---- my inbox + outbox ------------------------------------------------
+    if (/^WITH mine AS \(/.test(sql)) {
+      const floor = accountFloor(sql, { axis: 'active' });
+      const gid = params[0]; const days = Number(params[1]); const cap = Number(params[2]);
+      const fresh = (r) => r.status === 'pending' && r.created_at > Date.now() - days * DAY;
+      const pick = (side, other) => edges
+        .filter((r) => fresh(r) && String(r[side]) === String(gid))
+        .sort((a, b) => b.created_at - a.created_at || b.id - a.id)
+        .slice(0, cap)
+        .map((r) => ({ ...r, other: r[other] }));
+      const all = [
+        ...pick('addressee_github_id', 'requester_github_id').map((r) => ({ ...r, incoming: true })),
+        ...pick('requester_github_id', 'addressee_github_id').map((r) => ({ ...r, incoming: false })),
+      ].filter((r) => floor(findAccount(r.other)));
+      all.sort((a, b) => b.created_at - a.created_at || b.id - a.id);
+      return {
+        rows: all.map((r) => ({
+          id: String(r.id), note: r.note, created_at: iso(r.created_at), seen_at: iso(r.seen_at),
+          incoming: r.incoming, ...counterparty(r.other),
+        })),
+        rowCount: all.length,
+      };
+    }
+    if (/^UPDATE platform_identity_connections SET seen_at = now\(\)/.test(sql)) {
+      const hit = edges.filter(predicateFor(/WHERE (.+)$/.exec(sql)[1], params));
+      for (const r of hit) r.seen_at = Date.now();
+      return { rows: [], rowCount: hit.length };
+    }
+
+    // ---- the degree label -------------------------------------------------
+    if (/AS is_first/.test(sql)) {
+      const visitorFloor = accountFloor(sql, { axis: 'active' });
+      const [viewer, target, fanout1] = params;
+      const v1 = neighbours(viewer).filter((g) => visitorFloor(findAccount(g)))
+        .sort((a, b) => a - b).slice(0, Number(fanout1));
+      const t1 = neighbours(target).sort((a, b) => a - b).slice(0, Number(fanout1));
+      const mutuals = v1.filter((g) => t1.some((x) => String(x) === String(g)))
+        .sort((a, b) => a - b).map(counterparty);
+      const isFirst = edges.some((r) => r.status === 'accepted'
+        && Math.min(r.requester_github_id, r.addressee_github_id) === Math.min(Number(viewer), Number(target))
+        && Math.max(r.requester_github_id, r.addressee_github_id) === Math.max(Number(viewer), Number(target)));
+      return { rows: [{ is_first: isFirst, v1_count: v1.length, mutuals }], rowCount: 1 };
+    }
+    if (/AS is_third/.test(sql)) {
+      const nearFloor = accountFloor(sql, { axis: 'active' });
+      const farFloor = accountFloor(sql, { axis: 'visible' });
+      const [viewer, target, fanout1, fanout2] = params;
+      const v1 = neighbours(viewer).filter((g) => nearFloor(findAccount(g)))
+        .sort((a, b) => a - b).slice(0, Number(fanout1));
+      const v2 = [...new Set(v1.flatMap((g) => neighbours(g)))]
+        .filter((g) => farFloor(findAccount(g)))
+        .filter((g) => String(g) !== String(viewer) && !v1.some((x) => String(x) === String(g)))
+        .sort((a, b) => a - b).slice(0, Number(fanout2));
+      const t1 = neighbours(target).sort((a, b) => a - b).slice(0, Number(fanout1));
+      return { rows: [{ is_third: v2.some((g) => t1.some((x) => String(x) === String(g))), v2_count: v2.length }], rowCount: 1 };
+    }
+
+    // ---- ask --------------------------------------------------------------
+    if (/^WITH expired AS \(/.test(sql)) {
+      const expWhere = /UPDATE platform_identity_connections c SET status = 'expired'.*? WHERE (.+?) RETURNING/.exec(sql)[1];
+      for (const r of edges.filter(predicateFor(expWhere, params))) { r.status = 'expired'; r.resolved_at = Date.now(); }
+      const coolWhere = /SELECT 1 FROM platform_identity_connections c WHERE (.+?) \)/.exec(sql)[1];
+      if (edges.some(predicateFor(coolWhere, params))) return { rows: [], rowCount: 0 }; // swallowed
+      const open = edges.some((r) => ['pending', 'accepted'].includes(r.status)
+        && Math.min(r.requester_github_id, r.addressee_github_id) === Math.min(Number(params[0]), Number(params[1]))
+        && Math.max(r.requester_github_id, r.addressee_github_id) === Math.max(Number(params[0]), Number(params[1])));
+      if (open) { const e = new Error('duplicate key'); e.code = '23505'; throw e; }
+      const row = edge(Number(params[0]), Number(params[1]), 'pending', { note: params[4], created_at: Date.now(), resolved_at: null });
+      return { rows: [{ id: String(row.id) }], rowCount: 1 };
+    }
+
+    // ---- accept / decline -------------------------------------------------
+    let m = /^UPDATE platform_identity_connections SET status = '(accepted|rejected)'.*? WHERE (.+?) RETURNING/.exec(sql);
+    if (m) {
+      const hit = edges.filter(predicateFor(m[2], params));
+      for (const r of hit) { r.status = m[1]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: String(r.id) })), rowCount: hit.length };
+    }
+
+    // ---- remove / cancel --------------------------------------------------
+    if (/^WITH removed AS \( DELETE FROM platform_identity_connections/.test(sql)) {
+      const del = /DELETE FROM platform_identity_connections WHERE (.+?) RETURNING/.exec(sql)[1];
+      const upd = /UPDATE platform_identity_connections SET status = 'cancelled'.*? WHERE (.+?) RETURNING/.exec(sql)[1];
+      const out = [];
+      for (const r of edges.filter(predicateFor(del, params))) { edges = edges.filter((x) => x !== r); out.push({ outcome: 'removed' }); }
+      for (const r of edges.filter(predicateFor(upd, params))) { r.status = 'cancelled'; r.resolved_at = Date.now(); out.push({ outcome: 'cancelled' }); }
+      return { rows: out, rowCount: out.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+// ===========================================================================
+// The REAL route over that table, on a REAL socket
+// ===========================================================================
+
+let session = { github_id: ME, github_login: 'octo' };
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    parsePagination: helpers.parsePagination,
+    logger: () => ({ error() {}, warn() {}, info() {} }),
+    requireBuilder: (req, res, next) => {
+      if (!session) return res.fail('no_session', 401);
+      req.builder = { ...session };
+      next();
+    },
+  },
+};
+const buildConnectionRoutes = require('../modules/platform-identity/routes/connections.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildConnectionRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+// Every path the client asked for, in order — the evidence for "this page never
+// asks a question about someone else's connections".
+let asked = [];
+
+function call(method, path, body) {
+  asked.push(path);
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let data = null; try { data = JSON.parse(text); } catch { /* 204 */ }
+        resolve({ status: res.statusCode, ok: res.statusCode >= 200 && res.statusCode < 300, data });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ===========================================================================
+// The REAL client module in a DOM stub above that socket
+// ===========================================================================
+
+const escapeHtml = (s) => String(s)
+  .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+function makeEl() {
+  return {
+    hidden: false, disabled: false, dataset: {}, _html: '', _handlers: [],
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    addEventListener(type, fn) { this._handlers.push({ type, fn }); },
+  };
+}
+
+// Boot the real profile-connections.js. `transport` defaults to the live
+// loopback client; a test may pass a canned one for a shape only a hostile or
+// future server could send.
+function boot({ transport } = {}) {
+  const els = new Map();
+  const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
+  $('#conn-scroll').hidden = true; // the markup ships it hidden
+  const toasts = [];
+  const api = transport || { request: (method, path, opts = {}) => call(method, path, opts.body) };
+  const sandbox = {
+    console: { error() {}, warn() {}, log() {} },
+    window: {
+      BongosClient: { createClient: () => api },
+      OTB: { $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m) },
+      OTBKit: {
+        makePager: (prefix, key) => ({ prefix, key, page: 1, perPage: 25 }),
+        makeLedger: ({ mount, rowHtml, emptyMsg }) => ({
+          render(rows) {
+            mount.innerHTML = rows.length
+              ? rows.map((r, i) => rowHtml(r, i)).join('')
+              : `<div class="empty-state"><p>${emptyMsg}</p></div>`;
+          },
+        }),
+      },
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(CLIENT_SRC, sandbox, { filename: 'profile-connections.js' });
+  // Everything the section paints, as one string — in a real DOM the ledger
+  // mount is inside the body; in this stub they are two entries in the map.
+  const html = () => `${$('#conn-body').innerHTML}${$('#conn-ledger').innerHTML}`;
+  return { render: sandbox.window.OTBConnections.render, $, html, toasts, els };
+}
+
+const profileOf = (githubLogin, id) => ({ builder: { id, github_login: githubLogin } });
+
+// Drive a delegated click the way a browser would.
+async function click(page, dataset) {
+  const btn = { dataset, disabled: false };
+  const handler = page.$('#conn-body')._handlers.find((h) => h.type === 'click');
+  assert.ok(handler, 'the section never wired its click handler');
+  await handler.fn({ target: { closest: (sel) => (sel === 'button[data-act]' ? btn : null) } });
+  return btn;
+}
+
+// A fresh world for each test: the tables, the session, and the call log.
+function reset() { seed(); session = { github_id: ME, github_login: 'octo' }; asked = []; }
+
+// ===========================================================================
+// 0. The interpreter is the instrument, so it is calibrated before it is used
+// ===========================================================================
+
+test('the fake pool refuses a predicate it cannot read, rather than widening', () => {
+  assert.throws(() => predicateFor('id = $1 AND mood = $2', [1, 'blue']),
+    /unread predicate on \$2/,
+    'an unreadable filter must throw — silently ignoring it turns an owner check into no check');
+});
+
+test('the fake pool refuses a read that dropped its account floor', () => {
+  assert.throws(() => accountFloor('SELECT 1 FROM platform_identity_accounts pa', { axis: 'active' }),
+    /expected the consent floor/,
+    'a read that stopped joining the floor must break the harness, not pass it');
+});
+
+// ===========================================================================
+// 1. The surface: the section exists, ships hidden, and profile.js calls it
+// ===========================================================================
+
+test('profile.html ships the connections section hidden, and profile.js hands it the profile', () => {
+  assert.match(PROFILE_HTML, /<section[^>]*id="conn-scroll"[^>]*hidden>/,
+    'the section must ship hidden — it reveals only when the hub answered with something to show');
+  assert.match(PROFILE_HTML, /<script src="\/builders\/profile-connections\.js/);
+  assert.match(PROFILE_JS, /window\.OTBConnections\.render\(data, selfId\)/,
+    'profile.js must hand the section the profile it just rendered, or nothing ever calls it');
+  assert.match(PROFILE_JS, /const conn = \$\('#conn-scroll'\); if \(conn\) conn\.hidden = true;/,
+    'the empty state must blank this section like every other one');
+});
+
+// ===========================================================================
+// 2. Degree labels — every one of them over the real graph
+// ===========================================================================
+
+test('a 1st-degree connection renders "1st" and offers no Connect button', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('ada', 11), 99);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.match(page.html(), />1st</);
+  assert.match(page.html(), /You are connected\./);
+  assert.doesNotMatch(page.html(), /data-act="connect"/, 'you cannot ask someone you are already connected to');
+});
+
+test('a 2nd-degree connection names the mutuals it was computed from', async () => {
+  reset();
+  const page = boot();
+  // BO renamed: the page holds the old handle, the API follows it and echoes
+  // back the CANONICAL one, which is what the connect button must then carry.
+  await page.render(profileOf('bo-was', 12), 99);
+  assert.match(page.html(), />2nd</);
+  assert.match(page.html(), /1 connection in common: @ada/);
+  assert.match(page.html(), /data-handle="bo"/, 'the write must address the canonical handle, never the login the page happened to hold');
+});
+
+test('a 3rd-degree connection renders "3rd"', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('cy', 13), 99);
+  assert.match(page.html(), />3rd</);
+});
+
+// ===========================================================================
+// 3. THE null LABEL — the rule this whole section is most likely to break
+// ===========================================================================
+
+test('degree null renders "Out of network" and never "not connected"', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('zed', 14), 99);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.match(page.html(), /Out of network/);
+  assert.doesNotMatch(page.html(), /not connected/i,
+    'null is "we did not find a path", not "there is no relationship" — ADR 0202 says the copy must never claim the latter');
+  assert.doesNotMatch(page.html(), /\bnull\b/, 'the raw answer must never reach the screen');
+  // It still offers the ask — out of network is not a refusal.
+  assert.match(page.html(), /data-act="connect"/);
+});
+
+test('the out-of-network copy is byte-identical whether the expansion truncated or not', async () => {
+  reset();
+  const small = boot();
+  await small.render(profileOf('zed', 14), 99);
+  const before = small.html();
+
+  // Push the viewer past FANOUT_1 so the API really reports truncated:true.
+  const conn = require('../modules/platform-identity/connections.js');
+  for (let i = 0; i < conn.FANOUT_1; i++) {
+    const gid = 20000 + i;
+    accounts.push(acct(gid, `filler${i}`, `Filler ${i}`));
+    edge(ME, gid, 'accepted');
+  }
+  const truth = await call('GET', '/api/bongos/connections/degree/zed');
+  assert.equal(truth.data.degree, null);
+  assert.equal(truth.data.truncated, true, 'the fixture must actually reach the cap or this proves nothing');
+
+  const big = boot();
+  await big.render(profileOf('zed', 14), 99);
+  assert.equal(big.html(), before,
+    'the target’s own truncation is deliberately unreported (ADR 0207 L2); copy that varied with `truncated` would rebuild that side channel in words');
+  assert.doesNotMatch(big.html(), /truncat/i, '`truncated` must never reach the screen');
+});
+
+test('a degree the API never promised falls back to "out of network", never an invented label', async () => {
+  reset();
+  const page = boot({
+    transport: {
+      request: async (_m, path) => (path.startsWith('/api/bongos/connections/degree/')
+        ? { status: 200, ok: true, data: { handle: 'zed', degree: 4, mutuals: [], mutual_count: 0, truncated: false } }
+        : { status: 200, ok: true, data: { incoming: [], outgoing: [] } }),
+    },
+  });
+  await page.render(profileOf('zed', 14), 99);
+  assert.match(page.html(), /Out of network/);
+  assert.doesNotMatch(page.html(), /4th/, 'the client must not name a degree the API never defined');
+});
+
+// ===========================================================================
+// 4. Privacy — addressable to the people you connected with, and to nobody else
+// ===========================================================================
+
+test('a private stranger is not addressable: nothing renders, not even the handle', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('vic', 15), 99);
+  assert.equal(page.$('#conn-scroll').hidden, true, 'a 404 must leave the section hidden — there is nothing honest to show');
+  assert.equal(page.html(), '');
+  assert.doesNotMatch(page.html(), /vic/i);
+});
+
+test('a provisional account is not addressable, and answers the SAME way a private one does', async () => {
+  reset();
+  const priv = await call('GET', '/api/bongos/connections/degree/vic');
+  const prov = await call('GET', '/api/bongos/connections/degree/prov');
+  assert.equal(priv.status, 404);
+  assert.equal(prov.status, 404);
+  assert.deepEqual(prov.data, priv.data, 'the two must be indistinguishable, or the id space is probeable');
+  const page = boot();
+  await page.render(profileOf('prov', 16), 99);
+  assert.equal(page.$('#conn-scroll').hidden, true);
+});
+
+test('a private account you connected with is addressable to YOU and to nobody else', async () => {
+  reset();
+  const mine = boot();
+  await mine.render(profileOf('sec', 17), 99);
+  assert.equal(mine.$('#conn-scroll').hidden, false);
+  assert.match(mine.html(), />1st</, 'ADR 0202 D4 §2 — a private account you are connected to is addressable to you');
+
+  session = { github_id: OUTSIDER, github_login: 'outsider' };
+  const theirs = boot();
+  await theirs.render(profileOf('sec', 17), 99);
+  assert.equal(theirs.$('#conn-scroll').hidden, true, '…and to nobody else');
+  assert.equal(theirs.html(), '');
+});
+
+test('a private third party never appears in another builder’s page', async () => {
+  reset();
+  const page = boot();
+  // VIC is connected to BO. Rendering BO must not disclose that.
+  await page.render(profileOf('bo-was', 12), 99);
+  assert.match(page.html(), />2nd</);
+  assert.doesNotMatch(page.html(), /vic/i, 'BO’s own connections are not this page’s to show');
+});
+
+test('this page never asks a question about anyone else’s connections', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('bo-was', 12), 99);
+  assert.ok(asked.length > 0);
+  for (const path of asked) {
+    assert.match(path, /^\/api\/bongos\/connections(\/(requests|degree\/[^/]+))?$/,
+      `the section may only read its own scope; ${path} names a subject the session did not`);
+    assert.doesNotMatch(path, /\/builders\//, 'a per-builder connections read would be a public list, and there is deliberately no such route');
+  }
+});
+
+// ===========================================================================
+// 5. The connect button claims exactly what a 201 supports
+// ===========================================================================
+
+test('Connect sends the ask and then claims only "Request sent"', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('newbie', 18), 99);
+  assert.match(page.html(), /data-act="connect"[^>]*data-handle="newbie"|data-handle="newbie"/);
+
+  await click(page, { act: 'connect', handle: 'newbie' });
+  assert.deepEqual(page.toasts, ['Request sent.']);
+  const after = page.html();
+  assert.match(after, /Request sent/);
+  assert.match(after, /<button class="btn-ghost" type="button" disabled>/);
+  assert.doesNotMatch(after, /notif|they will|await|pending review|accept/i,
+    'a 201 { status: "pending" } supports "Request sent" and nothing else');
+  // and the row really is in the requester's outbox
+  const reqs = await call('GET', '/api/bongos/connections/requests');
+  assert.equal(reqs.data.outgoing.length, 1);
+  assert.equal(reqs.data.outgoing[0].handle, 'newbie');
+});
+
+test('a re-ask swallowed by the decline cooldown is INDISTINGUISHABLE, and its silence is left silent', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('cooled', 19), 99);
+  await click(page, { act: 'connect', handle: 'cooled' });
+  // Byte-identical to the real create above.
+  assert.deepEqual(page.toasts, ['Request sent.']);
+  assert.match(page.html(), /<button class="btn-ghost" type="button" disabled>Request sent<\/button>/);
+  // Nothing was written (ADR 0207 L1) — so on the next load the button is
+  // simply back, with NO explanation anywhere on the page.
+  const reqs = await call('GET', '/api/bongos/connections/requests');
+  assert.equal(reqs.data.outgoing.length, 0, 'the cooldown swallowed it — nothing is in the outbox');
+  const again = boot();
+  await again.render(profileOf('cooled', 19), 99);
+  assert.match(again.html(), /data-act="connect"/);
+  assert.doesNotMatch(again.html(), /declin|reject|cooldown|expired|disappear|again later/i,
+    'the API has no explanation to give, so the UI must invent none — that silence IS the decline’s protection');
+});
+
+test('an already-open relationship is reported as such and does NOT claim a request was sent', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('newbie', 18), 99);
+  assert.match(page.html(), /data-act="connect"/);
+  // The relationship opens between this page's outbox read and its click — a
+  // second tab, or the other party asking first. The 409 must not be painted
+  // as a request this page sent.
+  edge(ME, NEW, 'pending', { created_at: Date.now(), resolved_at: null });
+  await click(page, { act: 'connect', handle: 'newbie' });
+  assert.deepEqual(page.toasts, ['There is already a request or a connection between you.']);
+  assert.doesNotMatch(page.html(), /disabled>Request sent/,
+    'only a 201 may paint "Request sent" — a 409 says something else happened, not that you asked');
+  assert.match(page.html(), /data-act="connect"/, 'the button stays as it was, because nothing this page did changed it');
+});
+
+test('a target that stopped being addressable answers one message that names no reason', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('newbie', 18), 99);
+  accounts.find((a) => a.handle === 'newbie').account_visibility = 'private';
+  await click(page, { act: 'connect', handle: 'newbie' });
+  assert.deepEqual(page.toasts, ['That builder cannot be connected with right now.']);
+  assert.doesNotMatch(page.toasts.join(' '), /private|provisional|does not exist|unknown/i,
+    'absent, provisional and private are one answer — naming which one is the leak the 404 exists to prevent');
+});
+
+test('an incoming request turns the connect button into a decision, not a second ask', async () => {
+  reset();
+  edge(NEW, ME, 'pending', { created_at: Date.now() - DAY, note: 'hello' });
+  const page = boot();
+  await page.render(profileOf('newbie', 18), 99);
+  assert.match(page.html(), /They have asked to connect\./);
+  assert.match(page.html(), /data-act="accept"/);
+  assert.match(page.html(), /data-act="decline"/);
+  assert.doesNotMatch(page.html(), /data-act="connect"/, 'asking back would be a duplicate the database refuses anyway');
+});
+
+// ===========================================================================
+// 6. Counts are array lengths; seen_at never surfaces
+// ===========================================================================
+
+test('the mutual count is the length of the names beside it, not a number the response carried', async () => {
+  reset();
+  const page = boot({
+    transport: {
+      request: async (_m, path) => (path.startsWith('/api/bongos/connections/degree/')
+        ? { status: 200, ok: true, data: { handle: 'bo', degree: 2, mutuals: [{ handle: 'ada' }, { handle: 'cy' }], mutual_count: 9, truncated: false } }
+        : { status: 200, ok: true, data: { incoming: [], outgoing: [] } }),
+    },
+  });
+  await page.render(profileOf('bo', 12), 99);
+  assert.match(page.html(), /2 connections in common: @ada, @cy/);
+  assert.doesNotMatch(page.html(), /\b9\b/,
+    'a count beside a filtered list discloses the filtered members by subtraction (ADR 0171 D4)');
+});
+
+test('seen_at never reaches the screen, on either side of a request', async () => {
+  reset();
+  const stamped = edge(ADA, ME, 'pending', { created_at: Date.now() - DAY, seen_at: Date.now() - 3600000 });
+  const page = boot();
+  await page.render(profileOf('octo', 7), 7); // own profile
+  assert.match(page.html(), /Ada Lovelace/);
+  assert.doesNotMatch(page.html(), /seen/i);
+  assert.doesNotMatch(page.html(), new RegExp(new Date(stamped.seen_at).toISOString().slice(0, 10) + 'T'));
+  // and the API never even hands the requester one
+  session = { github_id: ADA, github_login: 'ada' };
+  const asRequester = await call('GET', '/api/bongos/connections/requests');
+  assert.equal(asRequester.data.outgoing.length, 1);
+  assert.ok(!('seen_at' in asRequester.data.outgoing[0]), 'an outgoing row must carry no read receipt');
+});
+
+// ===========================================================================
+// 7. Your own profile — the list, the queues, and the actions on them
+// ===========================================================================
+
+test('your own profile lists your connections, each 1st by definition, with both request queues', async () => {
+  reset();
+  edge(ADA, ME, 'pending', { created_at: Date.now() - DAY, note: 'worth comparing notes' });
+  edge(ME, NEW, 'pending', { created_at: Date.now() - DAY });
+  const page = boot();
+  await page.render(profileOf('octo', 7), 7);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  const html = page.html();
+  assert.match(html, /2 connections\./, 'the count is the length of the list the viewer was handed');
+  assert.equal((html.match(/conn-degree--1/g) || []).length, 2, 'every accepted connection is 1st by definition');
+  assert.equal((html.match(/>1st</g) || []).length, 2, '…and it says so — the class alone is not the label');
+  assert.match(html, /1 builder asking to connect/);
+  assert.match(html, /worth comparing notes/);
+  assert.match(html, /1 request you have sent/);
+  assert.match(html, /data-act="withdraw"/);
+  assert.match(html, /data-act="remove"/);
+  // SEC is private, and it is in MY OWN list — own scope floors on consent only.
+  assert.match(html, /@sec/);
+});
+
+test('accepting moves the asker into your connections; declining removes it and tells them nothing', async () => {
+  reset();
+  const ask = edge(ADA, ME, 'pending', { created_at: Date.now() - DAY });
+  const page = boot();
+  await page.render(profileOf('octo', 7), 7);
+  await click(page, { act: 'accept', id: String(ask.id) });
+  assert.ok(page.toasts.includes('Connected.'));
+
+  reset();
+  const spurned = edge(NEW, ME, 'pending', { created_at: Date.now() - DAY });
+  const page2 = boot();
+  await page2.render(profileOf('octo', 7), 7);
+  await click(page2, { act: 'decline', id: String(spurned.id) });
+  assert.ok(page2.toasts.includes('Declined.'));
+  assert.doesNotMatch(page2.html(), /Newbie/, 'the request leaves the inbox');
+  // The requester's own page says nothing about it.
+  session = { github_id: NEW, github_login: 'newbie' };
+  const theirs = boot();
+  await theirs.render(profileOf('newbie', 18), 18);
+  assert.doesNotMatch(theirs.html(), /declin|reject|refus/i, 'a decline is silent to the person declined (ADR 0202 D2 §1)');
+});
+
+test('removing a connection takes it out of the list', async () => {
+  reset();
+  const page = boot();
+  await page.render(profileOf('octo', 7), 7);
+  const id = /data-act="remove" data-id="(\d+)"/.exec(page.html())[1];
+  await click(page, { act: 'remove', id });
+  assert.ok(page.toasts.includes('Connection removed.'));
+  assert.match(page.html(), /1 connection\./);
+});
+
+// ===========================================================================
+// 8. Degrade, don't 500 — an instance without the hub has no section
+// ===========================================================================
+
+test('an instance without the connections routes renders no section at all', async () => {
+  reset();
+  const gone = { request: async () => ({ status: 404, ok: false, data: null }) };
+  const own = boot({ transport: gone });
+  await own.render(profileOf('octo', 7), 7);
+  assert.equal(own.$('#conn-scroll').hidden, true);
+  const other = boot({ transport: gone });
+  await other.render(profileOf('ada', 11), 99);
+  assert.equal(other.$('#conn-scroll').hidden, true);
+});
+
+test('a viewer whose own account is still provisional is told to activate it, and offered nothing else', async () => {
+  reset();
+  session = { github_id: PROV, github_login: 'prov' };
+  const page = boot();
+  await page.render(profileOf('ada', 11), 99);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.match(page.html(), /activate your profile/i);
+  assert.doesNotMatch(page.html(), /data-act=/, 'a provisional account cannot send, so it is offered no action');
+  assert.doesNotMatch(page.html(), /1st|2nd|3rd|Out of network/,
+    'the label is about the relationship, and a provisional viewer has none the API will compute');
+  // Their own profile degrades the same way: nothing to show, so nothing shows.
+  const own = boot();
+  await own.render(profileOf('prov', 16), 16);
+  assert.equal(own.$('#conn-scroll').hidden, true);
+});
+
+test('a signed-out visitor is offered no connect affordance', async () => {
+  reset();
+  session = null; // requireBuilder refuses
+  const page = boot();
+  await page.render(profileOf('ada', 11), 99);
+  assert.equal(page.$('#conn-scroll').hidden, true);
+  assert.equal(page.html(), '');
+});
+
+// ===========================================================================
+// 9. Lane proof — a test that never runs is not a gate (task 1002806)
+// ===========================================================================
+
+test('this proof runs in the DB-free lane that executes on every PR', () => {
+  const runner = readFileSync(join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/profile_connections_ui/.test(runner),
+    'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing',
+  );
+});