@bongos/core 1.19.428 → 1.19.429

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1588,
-    "unique_ids": 1382,
-    "certain": 1588,
+    "strings": 1589,
+    "unique_ids": 1383,
+    "certain": 1589,
     "heuristic": 0,
     "duplicate_ids": 157
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 73,
-      "strings": 1164
+      "files": 74,
+      "strings": 1165
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -623,7 +623,7 @@
       "text": "Cross-project record",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile.html:47",
+        "modules/hall-ui/public/profile.html:52",
         "modules/hall-ui/public/settings.html:86"
       ]
     },
@@ -1183,8 +1183,8 @@
       "text": "Request sent",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile-connections.js:82",
-        "modules/hall-ui/public/profile-connections.js:130"
+        "modules/hall-ui/public/profile-connections.js:86",
+        "modules/hall-ui/public/profile-connections.js:134"
       ]
     },
     {
@@ -2141,7 +2141,7 @@
       "surface": "builders-hall",
       "text": "Activity, by craft",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 84,
+      "line": 89,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -2663,7 +2663,7 @@
       "surface": "builders-hall",
       "text": "By the numbers",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 37,
+      "line": 42,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -3599,7 +3599,7 @@
       "surface": "builders-hall",
       "text": "Could not load the profile.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 620,
+      "line": 625,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4112,7 +4112,7 @@
       "surface": "builders-hall",
       "text": "Cross-project record",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 47,
+      "line": 52,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -4517,7 +4517,7 @@
       "surface": "builders-hall",
       "text": "Every idea this builder captured — promoted, discarded, merged, or still open.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 104,
+      "line": 109,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -4895,7 +4895,7 @@
       "surface": "builders-hall",
       "text": "Goals created",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 96,
+      "line": 101,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -5201,7 +5201,7 @@
       "surface": "builders-hall",
       "text": "Ideas filed, and what became of them",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 103,
+      "line": 108,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -5678,7 +5678,7 @@
       "surface": "builders-hall",
       "text": "Loading profile…",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 23,
+      "line": 28,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7334,7 +7334,7 @@
       "surface": "builders-hall",
       "text": "Recent works",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 61,
+      "line": 66,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7577,7 +7577,7 @@
       "surface": "builders-hall",
       "text": "Request sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 82,
+      "line": 86,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7586,7 +7586,7 @@
       "surface": "builders-hall",
       "text": "Request sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 130,
+      "line": 134,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7905,6 +7905,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a9c398651862",
+      "surface": "builders-hall",
+      "text": "See the cross-project record",
+      "file": "modules/hall-ui/public/profile-canonical.js",
+      "line": 114,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "17d5b5739f46",
       "surface": "builders-hall",
@@ -8162,7 +8171,7 @@
       "surface": "builders-hall",
       "text": "Sign in to the platform once to activate your profile before connecting.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 216,
+      "line": 220,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8288,7 +8297,7 @@
       "surface": "builders-hall",
       "text": "Something went wrong. Try again.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 271,
+      "line": 275,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8594,7 +8603,7 @@
       "surface": "builders-hall",
       "text": "That request is no longer available.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 266,
+      "line": 270,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8729,7 +8738,7 @@
       "surface": "builders-hall",
       "text": "The most recent works this builder has shipped.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 62,
+      "line": 67,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -8954,7 +8963,7 @@
       "surface": "builders-hall",
       "text": "They have asked to connect.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 199,
+      "line": 203,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9458,7 +9467,7 @@
       "surface": "builders-hall",
       "text": "What this builder has done, seen one craft at a time.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 85,
+      "line": 90,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -9638,7 +9647,7 @@
       "surface": "builders-hall",
       "text": "Works completed",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 91,
+      "line": 96,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -11420,7 +11429,7 @@
       "surface": "builders-hall",
       "text": "{…} asking to connect",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 132,
+      "line": 136,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11663,7 +11672,7 @@
       "surface": "builders-hall",
       "text": "{…} you have sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 133,
+      "line": 137,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -244,7 +244,7 @@
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
 │       └── map.js               ← (Phase D + ADR 0012): two-grid INITIAL_MAP {ground, objects}; isBlocked checks both layers (mirrors public/game/world/{terrain,map}.js)
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
-│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
+│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
 ├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
 ├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json; release recipe docs/recipes/devbox-app-release.md
@@ -351,6 +351,7 @@ tests/
 ├── own_scope_guard.mjs           ← (task 1003343, goal 1000045 criterion own-scope-held-by-a-test): the OWN-SCOPE structural guard, generalised out of memory_isolation.mjs. An explicit inventory of own-scoped route files; inside them the route's declared PATH decides — a path naming no builder must never read a subject from the request (direct, optional-chained, destructured, aliased, computed-key or header), a path that DOES name one needs a per-route exemption whose gate the guard verifies is present. Repo-wide backstop: any file mounting a `/me` route must be in the inventory. Source-grepping, so it runs in the DB-free `unit` lane.
 ├── account_existence_rate_limit.mjs ← (task 1003339, goal 1000045, ADR 0209): the two PUBLIC account-existence probes (onboarding GET /access-requests/status + core GET /auth/web/admission-status) share ONE per-IP budget. Counts to the limit on each route, proves the budget is shared in both directions and when alternated, moves Date.now to prove the window slides on the real mounted route, and proves a refused probe issues no query. DB-free; mutation-checked three ways.
 ├── effective_visibility_predicate.mjs ← (task 1002967, goal 1000045): the EFFECTIVE-VISIBILITY structural guard over `modules/platform-identity/account-visibility.js` (the file task 1002295 landed and this task ADOPTED rather than duplicating). Three layers — SQL and JS agree row-for-row over the privacy-spec D2 matrix; that file is the only one allowed to compare `profile_state`/`account_visibility`/`hide_stats` to a literal (per-occurrence exemptions, each with a reason and a checked obligation); and every `SELECT` on `platform_identity_accounts` is enumerated FROM SOURCE and must join a shared predicate, be declared non-public, or be a checked deferral to a named caller — so a read that does not exist yet (hub search, the sitemap) fails the build until its author classifies it. Behavioural half runs the real `/profiles/:handle` route over an in-memory accounts table filtered by each statement's own WHERE clause: private → 404 (never 403), byte-identical to stranger and owner alike. DB-free `unit` lane.
+├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.

package/docs/module-api-changelog.md

@@ -1293,5 +1293,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.426 with no explicit bump. run 33271340372. (task 1002620)
   1.19.428 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.427 with no explicit bump. run 33274315388. (task 1002620)
+  1.19.429 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.428 with no explicit bump. run 33274860035. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/profile-canonical.js

@@ -0,0 +1,137 @@
+// modules/hall-ui/public/profile-canonical.js — the canonical-profile wiring on
+// the hall's profile page (P08, task 1002804; ADR 0214, ADR 0171 D1,
+// profile-page spec Decision 1).
+//
+// ONE ANSWER, THREE BEHAVIOURS. A builder has exactly one canonical public
+// profile, at <hub>/u/<handle>. What this page does about that depends on which
+// instance is serving it, and the two cases are opposites:
+//
+//   * THE HUB serves the same person's canonical page itself, from the same
+//     database. Two URLs for one page on one host is the duplication Decision 1
+//     exists to end, so the numeric ?id= form REDIRECTS to the handle URL.
+//   * A FEDERATED INSTANCE shows its OWN rank, works and achievements here —
+//     genuinely different content — so it must not redirect. It stays the local
+//     view, declares the hub page canonical, and LINKS OUT to the cross-project
+//     record rather than inlining numbers it would have to keep fresh
+//     (ADR 0171 D1: an instance-side copy is stale the moment a builder hides).
+//   * A VANILLA INSTANCE has no hub. Nothing here does anything.
+//
+// A page cannot both redirect to a URL and declare it canonical, and it does not
+// have to: those are two different instances.
+//
+// IT IS ALL DARK TODAY, ON PURPOSE. `/u/<handle>` does not exist yet — the page
+// is goal 1000048 R14, and the ADR that fixes its PATH (R01) is unwritten. A
+// rel=canonical naming a 404 consolidates nothing and risks the one page that
+// works, so CANONICAL_PROFILE_PAGE_LIVE is false and every branch below is a
+// no-op. ADR 0214 D1 carries the argument.
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016): a canonical URL is an address, never a
+// grant. And nothing here decides who is visible — the server already did that
+// by omitting `handle` for an account that is absent, provisional or private,
+// identically in all three cases (ADR 0214 D5).
+
+(() => {
+  'use strict';
+
+  // BOUNDARY-FORCED DUPLICATION (the ADR 0091 §2 pattern, as
+  // platform-identity.js already does for the display-name cap): a browser
+  // script cannot require modules/platform-identity/canonical-profile.js, so the
+  // two constants below MIRROR it. tests/canonical_profile_url.mjs reads both
+  // files and fails if they ever disagree, which is what keeps this a mirror
+  // rather than a second opinion. Flip the module's copy and this one together.
+  const CANONICAL_PROFILE_PAGE_LIVE = false;
+  const CANONICAL_PROFILE_PREFIX = '/u/';
+
+  // Same charset the module re-checks: a handle is about to be interpolated into
+  // an href and a <link rel=canonical>, so it is validated here too rather than
+  // trusted because it arrived over the wire.
+  const HANDLE_RE = /^[a-z0-9-]{1,39}$/;
+
+  // The hub apex, stamped server-side into a <meta> (never a script global, and
+  // never straight into an href — an empty value in an href would silently
+  // become a same-host relative URL claiming to be the hub). Absent or empty
+  // means "no hub", and every branch below then does nothing.
+  function hubOrigin() {
+    const meta = document.querySelector('meta[name="hub-origin"]');
+    const raw = ((meta && meta.getAttribute('content')) || '').trim().replace(/\/+$/, '');
+    if (!raw) return null;
+    // Bare https origin only — a canonical must never name a downgraded scheme,
+    // and a value carrying a path is not an origin.
+    try {
+      const url = new URL(raw);
+      if (url.protocol !== 'https:' || url.username || url.password) return null;
+      if (url.pathname !== '/' || url.search || url.hash) return null;
+      return url.origin;
+    } catch (err) { return null; }
+  }
+
+  // The canonical public profile URL, or null when we must not point anywhere:
+  // the page is not live, no hub is known, or the account has no public handle
+  // (absent / provisional / private — indistinguishable by design).
+  function canonicalProfileUrl(handle) {
+    if (!CANONICAL_PROFILE_PAGE_LIVE) return null;
+    const origin = hubOrigin();
+    if (!origin) return null;
+    const h = String(handle == null ? '' : handle).trim().toLowerCase();
+    if (!HANDLE_RE.test(h)) return null;
+    return `${origin}${CANONICAL_PROFILE_PREFIX}${h}`;
+  }
+
+  // "Am I the hub?" — the enabled-module set the server injects. `platform-
+  // identity` IS the hub flag rather than a proxy for it (src/platform-server.js
+  // says so), so this asks the instance what it is and nothing has to know the
+  // platform's hostname.
+  function isHub() {
+    const mods = window.__MODULES__;
+    return Array.isArray(mods) ? mods.includes('platform-identity') : !!(mods && mods['platform-identity']);
+  }
+
+  function setCanonicalLink(url) {
+    let link = document.querySelector('link[rel="canonical"]');
+    if (!link) {
+      link = document.createElement('link');
+      link.setAttribute('rel', 'canonical');
+      document.head.appendChild(link);
+    }
+    link.setAttribute('href', url);
+  }
+
+  // The visible link-out — ADR 0171 D1's federated render path. It reuses the
+  // page's existing cross-project section, which on a federated instance is
+  // empty and hidden (the response carries no cross_project key there), so the
+  // heading a reader already understands gets the link instead of numbers.
+  function renderLinkOut(url) {
+    const section = document.getElementById('xp-scroll');
+    const body = document.getElementById('xp-body');
+    if (!section || !body) return;
+    // Defence in depth, and honestly UNOBSERVABLE today: canonicalProfileUrl has
+    // already refused anything outside `https://<bare origin>/u/[a-z0-9-]{1,39}`,
+    // so no value reaching here can contain a character this changes. It is the
+    // second wall for the day someone loosens the handle charset — a mutation
+    // test cannot make it bite, and that is the point rather than a gap.
+    const escapeHtml = (window.OTB && window.OTB.escapeHtml) || ((s) => String(s));
+    body.innerHTML = `<p class="scroll__lede">This builder's work spans more than this project. `
+      + `<a href="${escapeHtml(url)}" rel="noopener">See the cross-project record</a>.</p>`;
+    section.hidden = false;
+  }
+
+  // render(data) — called by profile.js once the profile response is in hand.
+  // `data.handle` is present iff the builder has a PUBLICLY VISIBLE platform
+  // account; absent for no account, provisional and private alike, so nothing
+  // here can tell those apart and neither can a visitor watching it.
+  function render(data) {
+    const url = canonicalProfileUrl(data && data.handle);
+    if (!url) return;
+    if (isHub()) {
+      // The hub's numeric form is an address for a page the hub also serves at
+      // the canonical URL. `replace`, not `assign`: the numeric URL should not
+      // sit in history as a place Back returns to.
+      if (new URLSearchParams(location.search).get('id')) location.replace(url);
+      return;
+    }
+    setCanonicalLink(url);
+    renderLinkOut(url);
+  }
+
+  window.OTBCanonical = { render, canonicalProfileUrl, hubOrigin, isHub };
+})();

package/modules/hall-ui/public/profile-connections.js

@@ -45,14 +45,18 @@
 // why `hide_stats` does not suppress it — hiding your stats hides the numbers
 // beside an edge, not the edge itself (ADR 0202 D4 §3).
 //
-// ADDRESSING. The connections API names a counterparty by HANDLE; this page
-// knows only a builder's github_login. It hands that login to
-// GET /connections/degree/:handle, which resolves the current handle or the
-// single previous-handle rename slot and echoes the CANONICAL handle back —
-// and that echoed handle, never the login, is what every write here sends. A
-// login resolving to neither answers 404 and the section stays hidden, the same
-// fail-closed answer a private or provisional account gets. The handle-addressed
-// hub page (/u/<handle>) will not need this hop at all.
+// ADDRESSING. The connections API names a counterparty by HANDLE. Since task
+// 1002804 the profile response carries the canonical `handle` itself (whenever
+// the builder has a publicly visible platform account), so this page addresses
+// by that and the login hop is only the FALLBACK for a server that predates it.
+// That fallback is the one with the hole, and it is why the widening mattered:
+// GET /connections/degree/:handle resolves a login against the current handle or
+// the SINGLE previous-handle rename slot, so a twice-renamed builder matched
+// neither, answered 404, and the section silently never appeared — the honest
+// gap ADR 0212 named and left open. Either way the API echoes the CANONICAL
+// handle back, and that echoed handle, never the login, is what every write here
+// sends. An address resolving to nothing answers 404 and the section stays
+// hidden, the same fail-closed answer a private or provisional account gets.
 
 (() => {
   'use strict';
@@ -288,7 +292,14 @@
     const builder = (data && data.builder) || {};
     const isSelf = selfId != null && String(builder.id) === String(selfId);
     try {
-      const shown = isSelf ? await renderOwn(body) : await renderOther(body, builder.github_login);
+      // Address by the CANONICAL handle when the response carries one (task
+      // 1002804 widened the profile read to include it), and fall back to the
+      // github_login hop for a server that predates that. The fallback is the
+      // thing with the hole: the rename window is a SINGLE previous_handle slot,
+      // so a twice-renamed builder's login matches neither and the section
+      // silently never appears — the honest gap ADR 0212 named and this closes.
+      const address = (data && typeof data.handle === 'string' && data.handle) || builder.github_login;
+      const shown = isSelf ? await renderOwn(body) : await renderOther(body, address);
       section.hidden = !shown;
       if (shown && body.addEventListener && !body.dataset.connWired) {
         body.dataset.connWired = '1';

package/modules/hall-ui/public/profile.html

@@ -5,6 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Profile — {{worldName}}</title>
   <meta name="description" content="A builder of {{worldName}} — rank, works shipped, standing, and achievements.">
+  <!-- The platform hub's apex, stamped server-side (P08, task 1002804; ADR 0214
+       D2). Empty on a vanilla instance, and profile-canonical.js renders nothing
+       then — a meta, never an href, so an empty value cannot degrade into a
+       same-host URL claiming to be the hub. -->
+  <meta name="hub-origin" content="{{hubOrigin}}">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -145,6 +150,10 @@
      exists by the time renderProfile runs; profile.js guards on it anyway, so a
      page that omits this script simply has no connections section. -->
 <script src="/builders/profile-connections.js?v=2026-08-29-r20"></script>
+<!-- Canonical-profile wiring (P08). Loaded BEFORE profile.js so
+     window.OTBCanonical exists when renderProfile runs; profile.js guards on it,
+     so a page that omits this script simply declares no canonical. -->
+<script src="/builders/profile-canonical.js?v=2026-08-29-p08"></script>
 <script src="/builders/profile.js?v=2026-08-27-activity"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -538,6 +538,11 @@
     // reveals its own section or leaves it hidden. Optional by design: a page
     // that does not load it simply has no connections section.
     if (window.OTBConnections) window.OTBConnections.render(data, selfId);
+    // Canonical-profile wiring (P08, task 1002804) — the rel=canonical + the
+    // link-out to the cross-project record on a federated instance, and the
+    // numeric-id redirect on the hub. Optional the same way: a page without the
+    // script declares no canonical rather than breaking.
+    if (window.OTBCanonical) window.OTBCanonical.render(data);
   }
 
   // Render the friendly "no builder chosen" empty state for a signed-out visitor

package/modules/platform-identity/canonical-profile.js

@@ -0,0 +1,143 @@
+// modules/platform-identity/canonical-profile.js — THE one answer to "where
+// does this builder's canonical public profile live, and is it safe to point
+// there?" (P08, task 1002804; ADR 0214; profile-page spec Decision 1, ADR 0171
+// D1/D8).
+//
+// WHY ITS OWN FILE. Three surfaces need the same answer — the `rel=canonical`
+// a federated instance emits, the visible "see the cross-project record" link
+// beside it, and the numeric-id redirect the hub performs. Three surfaces each
+// building their own URL is three ways to disagree about where a profile lives
+// and, worse, three independent judgements about whether the target exists yet.
+// One resolver removes both. (platform-identity.js is also at its file-size
+// ratchet with zero headroom, which is why this lands beside it rather than in
+// it — the account-visibility.js precedent.)
+//
+// THE FLAG IS THE POINT. `/u/<handle>` does not exist: the page is goal 1000048
+// R14 (task 1002365, `backlog`), the SEO-namespace ADR that fixes its PATH is
+// R01 (`ready`, unwritten), and R03 in the same goal proposes moving platform
+// pages under /bongos/…. A rel=canonical naming a URL that 404s consolidates
+// nothing — a 404 cannot be indexed — while risking the one page that does
+// work. So the resolver answers null and every consumer renders nothing.
+// ADR 0214 D1 carries the full argument and the flip checklist.
+//
+// Not authority (ADR 0016): a canonical URL is an address, never a grant.
+'use strict';
+
+const { isAccountVisible } = require('./account-visibility');
+
+// The canonical profile namespace on the hub (profile-page spec Decision 1).
+// One spelling, so nothing hardcodes '/u/' a second time.
+const CANONICAL_PROFILE_PREFIX = '/u/';
+
+// FALSE until the page at CANONICAL_PROFILE_PREFIX actually resolves. Flipping
+// this turns on the canonical link, the link-out and the numeric-id redirect
+// together, everywhere, at once — which is exactly why it is one boolean and
+// not three.
+//
+// Flip it only when ALL FOUR hold (ADR 0214 D1):
+//   1. goal 1000048 R14 (task 1002365) serves the page at this path;
+//   2. R01 has ratified that path — R03 may still move platform pages;
+//   3. the page answers 404, never 403, for absent / provisional / private,
+//      matching GET /profiles/:handle;
+//   4. P09's noindex-until-first-ship is in place, so flipping does not publish
+//      a farm of empty profiles.
+// tests/canonical_profile_url.mjs fails if a /u/ page route lands in the tree
+// while this is still false, so the flag cannot silently fall behind the page.
+const CANONICAL_PROFILE_PAGE_LIVE = false;
+
+// A handle is the URL key, so it may only ever be the charset P01 normalizes to
+// (lowercase alnum + hyphen). Re-checked HERE rather than trusted, because this
+// value is about to be interpolated into a URL that goes into an href and a
+// <link rel=canonical>: a resolver that builds URLs should refuse anything it
+// cannot vouch for rather than rely on every future caller having normalized.
+const HANDLE_RE = /^[a-z0-9-]{1,39}$/;
+
+// An origin is only usable as a canonical target if it is a bare https origin —
+// no path, no query, no credentials. http is refused outright: a canonical
+// pointing at a downgraded scheme is a signal we should never emit.
+function normalizeHubOrigin(origin) {
+  const raw = String(origin ?? '').trim().replace(/\/+$/, '');
+  if (!raw) return null;
+  let url;
+  try { url = new URL(raw); } catch { return null; }
+  if (url.protocol !== 'https:') return null;
+  if (url.username || url.password) return null;
+  if (url.pathname !== '/' || url.search || url.hash) return null;
+  return url.origin;
+}
+
+// canonicalProfilePath(handle) — the path half, or null for a handle this
+// resolver will not vouch for. Split out from the URL so the composition rules
+// stay provable while the liveness flag below is false: a gate that short-
+// circuits everything would otherwise leave the interesting logic untested.
+function canonicalProfilePath(handle) {
+  const h = String(handle ?? '').trim().toLowerCase();
+  return HANDLE_RE.test(h) ? `${CANONICAL_PROFILE_PREFIX}${h}` : null;
+}
+
+// canonicalProfileUrl(hubOrigin, handle) — the canonical public profile URL, or
+// null when we must not point anywhere: the page is not live, no hub origin is
+// known (a vanilla instance), the origin is not a bare https origin, or the
+// handle is absent/malformed. EVERY consumer renders nothing on null; none of
+// them may fall back to a guess.
+function canonicalProfileUrl(hubOrigin, handle) {
+  if (!CANONICAL_PROFILE_PAGE_LIVE) return null;
+  const origin = normalizeHubOrigin(hubOrigin);
+  const path = canonicalProfilePath(handle);
+  return origin && path ? `${origin}${path}` : null;
+}
+
+// getPublicHandle(githubId) — the account's PUBLIC handle, or null.
+//
+// Floors on the SHARED existence predicate (isAccountVisible), never a variant:
+// active AND public. Deliberately NOT the rollup predicate — `hide_stats`
+// suppresses NUMBERS and never existence (account-visibility.js; resolveHandle
+// says the same), so a builder who hides their stats still has a public profile
+// at a canonical URL, it just carries no numbers. Gating the handle on
+// hide_stats would deny a canonical URL and a connect button to exactly the
+// people who chose a public profile without public numbers.
+//
+// A null is returned identically for "no account", "provisional" and "private"
+// — the three cases ADR 0171 D2 requires to stay indistinguishable — so a
+// caller can never tell them apart, and neither can anything downstream of one.
+async function getPublicHandle(githubId, { pool }) {
+  if (githubId === null || githubId === undefined) return null;
+  const id = String(githubId);
+  // Non-numeric principals (the `system:*` ids) would blow up the bigint cast;
+  // they have no account, so answer the same null an absent row gets.
+  if (!/^\d+$/.test(id)) return null;
+  // THE ROW CARRIES EVERY COLUMN THE THREE SHARED PREDICATES READ, not just the
+  // ones this function happens to need — the getPublicProfileExtras shape.
+  //
+  // Two different reasons, both learned the hard way:
+  //  * `terms_accepted_at` is REQUIRED. Task 1002913 moved the T&C witness into
+  //    isAccountActive, which isAccountVisible composes from, so a row without
+  //    the column reads as un-consented and this function fail-closes to null
+  //    for EVERYONE. Fail-closed is the safe direction, but it is still broken.
+  //  * `hide_stats` is NOT read here, and is selected anyway so the CHOICE of
+  //    predicate is the only thing deciding the answer. Omit it and
+  //    isAccountVisible and isRollupVisible agree on every row — the predicate
+  //    looks load-bearing while being decorative, and a later swap to the wrong
+  //    one fails OPEN in silence.
+  //
+  // The rule this leaves behind: a reader that applies a shared predicate must
+  // SELECT that predicate's whole column set, or it is deciding on absent data.
+  const { rows } = await pool.query(
+    `SELECT handle, profile_state, account_visibility, terms_accepted_at, hide_stats
+       FROM platform_identity_accounts WHERE github_id = $1::bigint`,
+    [id],
+  );
+  const row = rows[0];
+  if (!isAccountVisible(row)) return null;
+  const handle = String(row.handle ?? '').trim().toLowerCase();
+  return HANDLE_RE.test(handle) ? handle : null;
+}
+
+module.exports = {
+  CANONICAL_PROFILE_PREFIX,
+  CANONICAL_PROFILE_PAGE_LIVE,
+  canonicalProfilePath,
+  canonicalProfileUrl,
+  normalizeHubOrigin,
+  getPublicHandle,
+};