@bongos/core 1.19.516 → 1.19.518

package/modules/lifecycle/mingle.js

@@ -306,6 +306,22 @@ async function openPairsFor(builderId, deps = {}) {
   return rows;
 }
 
+// How many open introductions are waiting on this builder — the count the hall's
+// needs roster renders (task 1003178 / C08). A COUNT rather than the rows,
+// because /me is the session-open hot path and the roster only needs a number;
+// the rows are `openPairsFor`, read by the surface that shows them.
+async function countOpenPairsFor(builderId, deps = {}) {
+  const activePool = deps.pool || pool;
+  const { rows } = await activePool.query(
+    `SELECT count(*)::int AS n
+       FROM lifecycle_mingle_pairs
+      WHERE status = 'proposed'
+        AND (builder_lo = $1 OR builder_hi = $1)`,
+    [builderId]
+  );
+  return rows[0] ? rows[0].n : 0;
+}
+
 // Accept or decline an introduction you are part of.
 //
 // ONE ROW, ONE TABLE. There is nothing else to write, and that absence IS the
@@ -333,5 +349,5 @@ module.exports = {
   parseEnabled, projectEnabled, setProjectEnabled,
   optInState, setOptIn, mingleStateFor,
   eligibleBuilders, isCrossCraft, planPairs, pairKey, openPairKeys,
-  runMingleRound, openPairsFor, decidePair,
+  runMingleRound, openPairsFor, countOpenPairsFor, decidePair,
 };

package/modules/lifecycle/routes/mingle.js

@@ -55,6 +55,11 @@ module.exports = function buildMingleRouter() {
     return res.json({
       mingle: state,
       open_pairs: pairs,
+      // task 1003178 (C08): WHICH SIDE OF THE PAIR THE CALLER IS. A pair row
+      // carries builder_lo/builder_hi with no marker for "you", so a surface
+      // rendering it from the viewer's side would otherwise need a second /me
+      // fetch just to find out which id to name. The route already knows.
+      you: String(req.builder.id),
       // Served VERBATIM from the module. The criterion asks for cross-craft to be
       // chosen deliberately and RECORDED; this is where it is read, and a
       // restatement here could drift from the matcher that actually runs.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.516",
+  "version": "1.19.518",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.516",
+      "version": "1.19.518",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.516",
+  "version": "1.19.518",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/me.js

@@ -105,7 +105,7 @@ module.exports = function buildMeRouter() {
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
-      taskRecommendationCount, boardVotesPending,
+      taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -205,6 +205,29 @@ module.exports = function buildMeRouter() {
           return await government.pendingBoardVotesFor(req.builder.id);
         } catch (_) { return null; }
       })(),
+      // task 1003178 (C08): SOCIAL MODE — the pair of switches C07 resolved
+      // (the project enabled mingle AND this builder opted in). It rides /me
+      // because the criterion's whole point is that social changes the HALL
+      // rather than adding a destination: every page already loads /me, so the
+      // shell can stamp the mode on the document and any surface can read it.
+      // Same fan-out slot and FAIL-OPEN posture as the reads above — null, not a
+      // throw, and the shell treats null as OFF (a mode that cannot be read is
+      // not on).
+      (async () => {
+        try {
+          const lifecycle = lc();
+          if (!lifecycle || !lifecycle.socialModeFor) return null;
+          return await lifecycle.socialModeFor(req.builder.id);
+        } catch (_) { return null; }
+      })(),
+      // The introductions waiting on this builder, for the needs roster.
+      (async () => {
+        try {
+          const lifecycle = lc();
+          if (!lifecycle || !lifecycle.openMingleIntroductionsFor) return 0;
+          return await lifecycle.openMingleIntroductionsFor(req.builder.id);
+        } catch (_) { return 0; }
+      })(),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -257,6 +280,19 @@ module.exports = function buildMeRouter() {
       // Resolved by economy (never re-derived); null if economy is disabled.
       reward: rewardPolicySafe(),
       est_vs_actual: estVsActual,
+      // task 1003178 (C08, goal 1000075): SOCIAL MODE. The owner's directive is
+      // that social is "scoped into the ENTIRE builders hall, not a single social
+      // tab", and this key is the mechanism: every hall page already loads /me,
+      // so the shell stamps the mode on the document and any surface reads it
+      // from there. A /social ROUTE is what the criterion explicitly does not
+      // accept, so there is deliberately no route to add — the mode travels with
+      // the identity the whole hall is already fetching.
+      //
+      // Shape: { enabled, project_enabled, opted_in, opted_in_at }, both switches
+      // reported separately so a surface can say WHICH half is off (C07). null
+      // when lifecycle is disabled or the read failed, and the shell treats null
+      // as OFF — a mode that cannot be read is not on.
+      social: socialMode,
       unlocked,
       locked_with_progress: lockedWithProgress,
       streak: {
@@ -354,6 +390,8 @@ module.exports = function buildMeRouter() {
         // this builder, read through the same `lifecycle` port so core never
         // imports the module (ADR 0093).
         openTaskRecommendations: taskRecommendationCount,
+        // task 1003178 (C08): open mingle introductions waiting on this builder.
+        openMingleIntroductions: mingleIntroductionCount,
       }) : [],
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.516'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.518'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_kit_charts.mjs

@@ -76,6 +76,55 @@ test('cumulate is a running total that survives holes', () => {
   assert.deepEqual(kit.cumulate([]), []);
 });
 
+test('cumulateByDay groups a day, cumulates it, and drops what will not parse', () => {
+  // The third caller of this shape put it in the kit (task 1003446): the
+  // profile's two lines and /drachmae's treasury.
+  const pts = kit.cumulateByDay([
+    { day: '2026-05-02T10:00:00Z', v: 1 },
+    { day: '2026-05-02T22:00:00Z', v: 2 },   // same day → one point
+    { day: '2026-05-04T00:00:00Z', v: 4 },
+  ], { valueOf: (r) => r.v });
+  assert.deepEqual(pts.map((p) => p.value), [3, 7], 'summed within a day, cumulative across');
+  assert.equal(pts.length, 2, 'a day with no row is not invented');
+  assert.ok(pts[0].x < pts[1].x, 'ascending');
+});
+
+test('an unparsable date is dropped, not counted at the epoch', () => {
+  // Counted at 0 it would stretch the axis back to 1970 and flatten every real
+  // point onto the floor — the failure mode is a chart, not an exception.
+  const pts = kit.cumulateByDay([
+    { day: 'not a date', v: 99 },
+    { day: '2026-05-02T10:00:00Z', v: 5 },
+  ], { valueOf: (r) => r.v });
+  assert.deepEqual(pts.map((p) => p.value), [5]);
+  assert.ok(pts[0].x > Date.parse('2020-01-01'), 'and the axis starts in this decade');
+});
+
+test('cumulateByDay reads the date column the caller names', () => {
+  // shipped_at on an activity row, recorded_at on a credits row, day on a
+  // gap-filled feed — only the caller knows which.
+  const pts = kit.cumulateByDay(
+    [{ recorded_at: '2026-05-02T10:00:00Z', delta: 8 }],
+    { dateOf: (r) => r.recorded_at, valueOf: (r) => r.delta },
+  );
+  assert.deepEqual(pts.map((p) => p.value), [8]);
+  assert.deepEqual(kit.cumulateByDay(null), [], 'and no rows is no points');
+});
+
+test('a plot with no readout ships no focus stop and no dead crosshair', () => {
+  // A role="img" with tabindex="0" is a focus stop a keyboard reader lands on
+  // with nothing to do; a crosshair nothing moves only looks like a feature.
+  const inert = kit.plotSvgHtml({ series: '<path/>', ariaLabel: 'Spent', interactive: false });
+  assert.doesNotMatch(inert, /tabindex/);
+  assert.doesNotMatch(inert, /kit-plot__hair/);
+  assert.match(inert, /aria-label="Spent"/, 'the label is still the reading');
+  assert.match(inert, /kit-plot__axis/, 'and the axis is still drawn');
+  // The default stays interactive, because the profile wires a readout.
+  const live = kit.plotSvgHtml({ series: '<path/>' });
+  assert.match(live, /tabindex="0"/);
+  assert.match(live, /kit-plot__hair/);
+});
+
 test('the line is scaled to its own min and max, and a flat series sits mid-box', () => {
   const g = kit.linePoints([0, 10], { width: 100, height: 50, pad: 0 });
   const ys = g.points.split(' ').map((p) => Number(p.split(',')[1]));

package/tests/hall_reference_world.mjs

@@ -220,3 +220,132 @@ test('the reference renders exactly one h1, the page head\'s', () => {
   assert.equal([...html.matchAll(/<h1\b/g)].length, 1);
   assert.match(html, /<h1 class="page-head__h">/);
 });
+
+// ---- 9. the treasury section (task 1003446) --------------------------------
+//
+// The sharpest version of goal 1000072's thesis. /drachmae is labelled Economy
+// in the nav and was a markdown reader with ZERO live numbers, while the
+// signed-out status page already drew this very endpoint's cumulative line and
+// the Work board fetched the same payload to read ONE scalar off it. The
+// stranger got the chart; the builder got the number.
+//
+// The section's ARITHMETIC is not asserted here — it is the kit's
+// (`cumulateByDay`, `timeStepSeriesHtml`, `barSeriesHtml`) and
+// tests/hall_kit_charts.mjs runs the real kit against it. What these hold is
+// the page's half of the contract, the half a kit test cannot see.
+
+const costSummaryFixture = JSON.parse(
+  fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'cost-summary.json'), 'utf8'),
+);
+
+test('the treasury reads the endpoint that already carried the series — no new route', () => {
+  // The whole point of the task: the payload had both series all along, and the
+  // route's own comment calls daily[] "the treasury chart's cumulative line".
+  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/gds\/public\/cost-summary'/);
+  assert.ok(costSummaryFixture.daily.length, 'the payload really carries daily[]');
+  assert.ok(costSummaryFixture.daily_credits.length, 'and daily_credits[]');
+  assert.ok(Number(costSummaryFixture.total_usd) > 0, 'and the totals the prose states');
+  assert.ok(Number(costSummaryFixture.total_value_credits) > 0);
+});
+
+test('RUN: the cumulative line ends exactly on the total the prose states', async () => {
+  // The invariant that matters, and the one a source-text assertion cannot
+  // reach: the chart and the sentence above it are derived from the SAME
+  // payload, so they can never disagree. Run against the real kit and the real
+  // checked-in summary, which is where a units or gap-fill mistake would show
+  // up as a line ending somewhere other than the headline number.
+  const kitPath = path.join(HALL, 'hall-kit.js');
+  const kit = await import(`file://${kitPath.replace(/\\/g, '/')}`).then((m) => m.default);
+  const spend = kit.cumulateByDay(costSummaryFixture.daily, { valueOf: (r) => r.amount_usd });
+  const earned = kit.cumulateByDay(costSummaryFixture.daily_credits, { valueOf: (r) => r.credits });
+  assert.ok(spend.length > 1 && earned.length > 1, 'both series have depth');
+  assert.ok(Math.abs(spend[spend.length - 1].value - Number(costSummaryFixture.total_usd)) < 1,
+    'the spend line ends on total_usd');
+  assert.equal(earned[earned.length - 1].value, Number(costSummaryFixture.total_value_credits),
+    'and the awarded line ends on total_value_credits');
+  // Whatever the plot draws from that must be finite — a NaN in a path `d`
+  // renders as an invisible chart with no error anywhere.
+  const series = kit.timeStepSeriesHtml(spend, {
+    x0: spend[0].x, x1: spend[spend.length - 1].x, yMax: spend[spend.length - 1].value,
+  });
+  assert.doesNotMatch(series.body, /NaN|Infinity/);
+  assert.doesNotMatch(
+    kit.barSeriesHtml(costSummaryFixture.by_category.map((c) => ({ label: c.category, value: c.total_usd }))),
+    /NaN|Infinity/,
+  );
+});
+
+test('the page loads the chart primitive BEFORE the script that reads it', () => {
+  // window.OTBKit read at insert time with the kit loaded after it is an empty
+  // section in production and a green unit suite.
+  const loaded = [...drachmaeHtml.matchAll(/<script[^>]+src="([^"?]+)/g)].map((m) => m[1].split('/').pop());
+  const kitAt = loaded.indexOf('hall-kit.js');
+  const pageAt = loaded.indexOf('drachmae.js');
+  assert.ok(kitAt > -1, 'drachmae.html must load hall-kit.js');
+  assert.ok(pageAt > -1, 'and drachmae.js');
+  assert.ok(kitAt < pageAt, 'kit first');
+});
+
+test('every mark on the page is drawn by the kit, none by hand', () => {
+  const js = dejscomment(drachmaeJs);
+  for (const fn of ['cumulateByDay', 'timeStepSeriesHtml', 'plotSvgHtml', 'plotValueLabelHtml', 'barSeriesHtml']) {
+    assert.match(js, new RegExp(`(kit|window\\.OTBKit)\\.${fn}\\(`), `the treasury draws through ${fn}`);
+  }
+  // The §6b audit rule holds this globally; asserted here too because THIS is
+  // the page that had no chart at all and so the easiest place to hand-roll one.
+  assert.doesNotMatch(js, /<(?:path|polyline|rect)\b[^>]*\b(?:d|points)="\$\{/,
+    'no hand-built SVG geometry on the reference page');
+});
+
+test('the section degrades to NOTHING rather than an empty panel', () => {
+  const js = dejscomment(drachmaeJs);
+  // The bounty section's contract, kept: a failed read leaves the prose alone
+  // and adds no outline entry that leads nowhere.
+  const fn = js.slice(js.indexOf('async function insertTreasurySection'));
+  const body = fn.slice(0, fn.indexOf('\n  }\n'));
+  assert.match(body, /console\.warn\([^)]*cost summary unavailable/);
+  assert.equal((body.match(/return false;/g) || []).length, 3,
+    'three honest exits: no kit, an unreadable summary, and a treasury with nothing in it');
+  assert.match(body, /if \(!spend\.length && !earned\.length\) return false;/,
+    'both series empty is one honest nothing, not two empty plots');
+});
+
+test('the plots ship no focus stop, because nothing here wires a readout', () => {
+  // A role="img" with tabindex="0" is a focus stop a keyboard reader lands on
+  // with nothing to do, and a crosshair nothing moves only looks like a
+  // feature. The kit half is asserted in tests/hall_kit_charts.mjs.
+  assert.match(dejscomment(drachmaeJs), /interactive: false/);
+});
+
+test('the currency is the branding pack\'s, never a hardcoded word', () => {
+  const js = dejscomment(drachmaeJs);
+  assert.match(js, /__BRANDING__ && window\.__BRANDING__\.currency/);
+  assert.match(js, /\|\| 'credits'/, 'with a neutral fallback, not a world-specific one');
+  assert.doesNotMatch(js.replace(/\|\| 'credits'/g, ''), /drachmae'/i,
+    'the instance\'s own currency name is not spelled into the core page');
+});
+
+test('the treasury lands ahead of the rate card, so the doc still ends on "dig deeper"', () => {
+  const js = dejscomment(drachmaeJs);
+  // The bounty section goes in first and the treasury anchors on its id, so the
+  // order is prose → what happened → the published rates → the closing links.
+  const boot = js.slice(js.indexOf('async function boot()'));
+  assert.ok(boot.indexOf('insertBountySection(article)') < boot.indexOf('insertTreasurySection(article)'),
+    'the rate card is inserted first, so the treasury can anchor ahead of it');
+  assert.match(js, /article\.querySelector\(`#\$\{BOUNTY_SECTION_ID\}`\)/);
+  assert.match(js, /CLOSING_H2\.test/, 'and it falls back to the closing links, then to appending');
+});
+
+test('the figure chrome is shared, because a second page now draws figures', () => {
+  // .pchart* moved from profile.css to style.css with this task. drachmae.html
+  // loads style.css and NOT profile.css, so a copy left behind would render
+  // this page's figures unstyled.
+  const style = decomment(read('style.css'));
+  const profile = decomment(read('profile.css'));
+  for (const sel of ['.pcharts', '.pchart ', '.pchart__title', '.pchart__twin', '.pchart__foot']) {
+    assert.ok(style.includes(sel), `${sel} is in the shared sheet`);
+  }
+  assert.ok(!/^\.pcharts\s*\{/m.test(profile), 'and not left duplicated in profile.css');
+  assert.match(drachmaeHtml, /style\.css/);
+  assert.doesNotMatch(drachmaeHtml, /profile\.css/, 'the reference page must not need the profile sheet');
+});

package/tests/mingle.mjs

@@ -283,6 +283,32 @@ test('a declined pair may be introduced again — a decline is not a permanent s
   assert.equal(mingle.planPairs(eligible, { excludePairs: new Set() }).length, 1);
 });
 
+test('the roster COUNT sees both sides of a pair, and only open ones', async () => {
+  // task 1003178 (C08) added countOpenPairsFor for the needs roster, and the
+  // grader was right that it shipped untested while every other DB function here
+  // is driven against the recording pool. A count is exactly the kind of query
+  // that goes wrong quietly: miss a side of the pair and half the hall never
+  // learns it has an introduction waiting.
+  const pool = {
+    queries: [],
+    async query(sql, params) {
+      this.queries.push({ sql, params });
+      return { rows: [{ n: 3 }] };
+    },
+  };
+  const n = await mingle.countOpenPairsFor(42, { pool });
+  assert.equal(n, 3);
+  const { sql, params } = pool.queries[0];
+  assert.match(sql, /builder_lo = \$1 OR builder_hi = \$1/, 'either side of the pair counts');
+  assert.match(sql, /status = 'proposed'/, 'a settled introduction is not waiting on anyone');
+  assert.deepEqual(params, [42]);
+});
+
+test('the count answers 0 rather than undefined on an empty read', async () => {
+  const pool = { async query() { return { rows: [] }; } };
+  assert.equal(await mingle.countOpenPairsFor(42, { pool }), 0);
+});
+
 test('the exclude set is built from OPEN pairs only, never from declines', async () => {
   const pool = recordingPool({ openPairs: [['1', '2']] });
   await mingle.openPairKeys({ pool });

package/tests/social_mode.mjs

@@ -0,0 +1,181 @@
+// tests/social_mode.mjs — with social on, the HALL changes; it does not gain a
+// tab (task 1003178 / C08, goal 1000075; criterion collab-hall-becomes-a-mode).
+//
+// The criterion is unusual in that it states its own DISQUALIFIER: "a /social
+// route with the same hall around it does NOT satisfy it". So the first block
+// below tests the absence — no route, no nav item, no page file — and the rest
+// tests that existing surfaces read differently instead.
+//
+// The owner's directive, verbatim in the goal: social "is certainly something
+// that should be scoped into the ENTIRE builders hall, not a single social tab".
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+const SHELL = read('modules', 'hall-ui', 'public', 'shell.js');
+const HALL_RENDER = read('modules', 'hall-ui', 'public', 'hall-render.js');
+const COLLAB_JS = read('modules', 'hall-ui', 'public', 'collab.js');
+const COLLAB_HTML = read('modules', 'hall-ui', 'public', 'collab.html');
+const ME = read('src', 'bongos', 'routes', 'me.js');
+const NEEDS = read('modules', 'builder-settings', 'builder-needs.js');
+const needs = require(path.join(ROOT, 'modules', 'builder-settings', 'builder-needs.js'));
+
+// ── 1. THE DISQUALIFIER: social is not a destination ────────────────────────
+
+test('THE DISQUALIFIER: there is no /social page in the hall', () => {
+  const hall = fs.readdirSync(path.join(ROOT, 'modules', 'hall-ui', 'public'));
+  for (const f of hall) {
+    assert.ok(!/^social\.(html|js|css)$/.test(f),
+      `${f} exists — a social PAGE is exactly what this criterion refuses`);
+  }
+});
+
+test('THE DISQUALIFIER: no /social route is served, and no page gate names one', () => {
+  const serve = read('src', 'bongos', 'serve-internal.js');
+  assert.ok(!/\/social\b/.test(serve), 'serve-internal routes nothing at /social');
+  const oracle = read('tests', 'hall_page_gate_map.mjs');
+  assert.ok(!/'\/builders\/social'/.test(oracle), 'the page-gate oracle has no /social row');
+});
+
+test('THE DISQUALIFIER: social adds no nav item', () => {
+  // A nav entry would BE the tab. The whole mechanism is an attribute on the
+  // document, so there is nothing to link to.
+  //
+  // The end marker is NAV_COLLAPSE_KEY, which follows the model. An earlier
+  // draft sliced to `function icon(` — which is DEFINED ABOVE NAV, so the slice
+  // returned an empty string and the assertion passed over nothing. It only
+  // surfaced because adding a real Social tab as a mutation did not red it.
+  const start = SHELL.indexOf('var NAV = [');
+  const end = SHELL.indexOf('var NAV_COLLAPSE_KEY');
+  assert.ok(start > -1 && end > start, 'the NAV model was actually located');
+  const nav = SHELL.slice(start, end);
+  assert.ok(nav.includes("id: 'roster'"), 'and the slice really holds the nav items');
+  assert.ok(!/social/i.test(nav), 'the nav model must not mention social');
+});
+
+// ── 2. SOCIAL IS A MODE, STAMPED ON THE DOCUMENT ────────────────────────────
+
+test('the shell stamps the mode on the document root, beside data-theme', () => {
+  // An attribute on <html> is what lets ANY surface — a stylesheet, a page
+  // script, a widget — read the mode without a route or a second fetch. That is
+  // the structural difference between a mode and a page.
+  assert.match(SHELL, /function applySocial\(social\)/);
+  assert.match(SHELL, /root\.dataset\.social = 'on'/);
+  assert.match(SHELL, /delete root\.dataset\.social/);
+});
+
+test('OFF is the default and the fallback — null is not on', () => {
+  // /me.social is null when lifecycle is disabled or the read failed. A mode
+  // that cannot be read is not on.
+  const fn = SHELL.slice(SHELL.indexOf('function applySocial'));
+  const body = fn.slice(0, fn.indexOf('\n  }'));
+  assert.match(body, /social && social\.enabled === true/,
+    'only an explicit enabled:true turns the mode on');
+});
+
+test('BOTH switches decide it, and the client never re-derives them', () => {
+  // C07 resolved the pair (project enabled AND builder opted in) server-side.
+  // A client that recomputed the mode could disagree with the rest of the hall.
+  assert.ok(!/opted_in|project_enabled/.test(SHELL),
+    'the shell reads `enabled`, never the two switches it came from');
+  assert.match(ME, /socialModeFor/);
+  assert.match(ME, /social: socialMode/);
+});
+
+test('the mode rides /me, which every hall page already fetches', () => {
+  // This is why no new route is needed — and why one would be the wrong shape.
+  assert.match(SHELL, /social: me\.social \|\| null/);
+  assert.match(HALL_RENDER, /social: \(ctx\.lastMeState && ctx\.lastMeState\.social\) \|\| null/);
+});
+
+test('the index passes the mode too — the busiest page is not the one it misses', () => {
+  // renderNav takes (builder, onboarding) and is called from five sites, so the
+  // value must come off the live ctx getter rather than a local `me`.
+  const fn = HALL_RENDER.slice(HALL_RENDER.indexOf('function renderNav('));
+  const body = fn.slice(0, fn.indexOf('\n  }'));
+  assert.ok(!/\bme\?\./.test(body), 'renderNav has no `me` in scope — reading one would throw');
+});
+
+test('a social read can never break a profile', () => {
+  // /me is the session-open hot path. Same fail-open posture as the C01/C03
+  // reads it sits beside.
+  const slot = ME.slice(ME.indexOf('socialModeFor') - 600, ME.indexOf('socialModeFor') + 200);
+  assert.match(slot, /catch \(_\) \{ return null; \}/);
+});
+
+// ── 3. EXISTING SURFACES READ DIFFERENTLY ───────────────────────────────────
+
+test('HOME changes: an introduction becomes a need in the roster', () => {
+  // The needs roster is how a collab feature reaches the whole hall — it is
+  // where C01 and C03 already live, and it renders on Home's Standing card and
+  // in the CLI nudge without either learning about mingle.
+  const roster = needs.computeNeeds({ openMingleIntroductions: 2 }).items;
+  const row = roster.find((n) => n.id === 'mingle_introductions');
+  assert.ok(row, 'the need is produced');
+  assert.equal(row.state, 'action_needed');
+  assert.match(row.action.href, /\/#\/collab/, 'it points at an EXISTING surface, not a new one');
+});
+
+test('no introductions means no row — the roster is not padded', () => {
+  assert.equal(needs.computeNeeds({ openMingleIntroductions: 0 }).items.find((n) => n.id === 'mingle_introductions'), undefined);
+  assert.equal(needs.computeNeeds({}).items.find((n) => n.id === 'mingle_introductions'), undefined);
+});
+
+test('the invitation never pressures — declining is free, so the copy says so', () => {
+  // Mingle is declinable without penalty (C07, ADR 0187 §5). Wording that
+  // pressured the reader would BE the penalty the decision forbids — the same
+  // argument the recommendation need makes, and it matters more for a social
+  // invitation than for a task.
+  const row = needs.computeNeeds({ openMingleIntroductions: 1 }).items;
+  const n = row.find((x) => x.id === 'mingle_introductions');
+  assert.equal(n.severity, 'info', 'info, never a demand');
+  assert.match(n.message, /costs nothing/);
+  assert.match(n.message, /does not change how often you are paired/,
+    'and it names the no-future-weight half, which is the part a reader would doubt');
+});
+
+test('COLLAB changes: the introductions panel is revealed BY THE MODE', () => {
+  // Not by a rank, not by a route, not by a second fetch — by the document
+  // attribute the shell stamped. That is what "the surface reads differently"
+  // means in practice.
+  assert.match(COLLAB_JS, /document\.documentElement\.dataset\.social === 'on'/);
+  assert.match(COLLAB_HTML, /id="cb-mingle-section"[^>]*hidden/);
+});
+
+test('with social OFF the page is exactly what it was, and costs nothing extra', () => {
+  // A page that fetched anyway would make "social is off" cost a request on
+  // every load, and a panel that rendered empty would still be a visible change.
+  const fn = COLLAB_JS.slice(COLLAB_JS.indexOf('async function loadMingle'));
+  const body = fn.slice(0, fn.indexOf('\n  }'));
+  const guard = body.indexOf('if (!socialOn())');
+  assert.ok(guard > -1, 'the mode is checked');
+  assert.ok(guard < body.indexOf("api.request('GET', '/mingle')"),
+    'and it is checked BEFORE anything is fetched');
+});
+
+test('the introductions read is best-effort — it cannot take the page down', () => {
+  // Help requests ARE the Collab page; the social half is additive.
+  assert.match(COLLAB_JS, /try \{ await loadMingle\(\); \} catch \(_\)/);
+});
+
+test('the row is written from the VIEWER\'s side, without a second /me', () => {
+  // A pair carries builder_lo/builder_hi with no marker for "you", so the route
+  // says which side the caller is rather than making the page fetch to find out.
+  const routes = read('modules', 'lifecycle', 'routes', 'mingle.js');
+  assert.match(routes, /you: String\(req\.builder\.id\)/);
+  assert.match(COLLAB_JS, /r\.data\.you/);
+  assert.match(COLLAB_JS, /function otherOf\(pair, meId\)/);
+});
+
+test('answering an introduction reads neutrally either way', () => {
+  // "Declined" must not read as a failure. A disappointed toast would be the
+  // penalty C07 forbids, delivered by the UI instead of the schema.
+  assert.match(COLLAB_JS, /Not now\. Nothing changes for you\./);
+});