@bongos/core 1.19.778 → 1.19.779

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.778",
-  "core_contract": "1.19.778",
-  "source_commit": "789aac3a01b8b02183c2dd2b3ebfee12bb25a703",
+  "core_version": "1.19.779",
+  "core_contract": "1.19.779",
+  "source_commit": "1b37b29ce2a7832804f9b44a6982ea25b57643e3",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T19:16:36.821Z",
+  "built_at": "2026-09-16T20:08:25.581Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 482,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2660,
-  "tree_sha256": "0b65b14c44cb8fe069f46bc63b1572cb3471d535843beda4b24ebade6173c4b1",
+  "tree_sha256": "dbb45ccb2f44e4771d7a73e06e5ac46faea7115961c48cac9da3877e62f2e61c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1327,7 +1327,7 @@
     {
       "path": "docs/adr/0171-profile-rollup-join-and-consent.md",
       "mode": "0000644",
-      "sha256": "e61c6a4a5c03092934ba452d0566f160488ae1c5ebc510ed08a3caeab1bba0a8"
+      "sha256": "943103bc2fcb66b89a06b13a49593d230b90f33bd3dec35aec82078cdd08f54f"
     },
     {
       "path": "docs/adr/0172-editable-rank-roles-substrate-axis.md",
@@ -1387,7 +1387,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "b5774a35062d556a9af643b0726408268c8d91f3a6c9273f4bb610510bbb7342"
+      "sha256": "15387fac9c92e30d305444616865b6aab0b0c391ddc91f08656c74b9e71385ad"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -2507,7 +2507,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4c8bb6807afb74e21e64f0b4d673b335eae7873f90563eb2077e49a210dfd85e"
+      "sha256": "b5409eae5a7466352e67fee988116c208a7c748e5dd88052f8a2b45a8e58f907"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6082,7 +6082,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "75034fda91db58e923e6838e8eb6aba92277643fe3ed930fce1e4b3b9a4bdc96"
+      "sha256": "c59bc528fb1bb451b1f1b751b2903b763b1d3e892a8a5bbc5144ee97db670cf3"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -6107,7 +6107,7 @@
     {
       "path": "modules/platform-identity/projects-feed.js",
       "mode": "0000644",
-      "sha256": "9a8a22d21089770ec80f709d27f798eab6101cfaead18942c439f7c8689ef041"
+      "sha256": "14166982e6306ff8dd63f476af582970634eb9c210e9afa76166668e351244c9"
     },
     {
       "path": "modules/platform-identity/publish-gate.js",
@@ -6167,7 +6167,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "32e6d5edd5e058687a641265e78e319ab4e905a85298e76623826c384d0c6356"
+      "sha256": "da06ab89ee01bf3a704f677e7e50041220916f40cac23fa063c212dc9af2f56d"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7612,12 +7612,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6352bb5bd1cf9b2b944dd8ae2baef9fa9a719036dacd4acf5c0104d65fa56dc0"
+      "sha256": "73c88d2a70b9f77171344eb76f4c5c9f2ecbbc4d1a1b6b3008d636e974b01f9b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "019205fa726bfcf5d7175ff8e5bdc7589e117bff7757b35b4d64168f1dc6c713"
+      "sha256": "4c30d22b31621113b656c60c5a7d71d70fc1544326be0d506ca16a242783defd"
     },
     {
       "path": "public-docs/index.html",
@@ -9477,7 +9477,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cc914f78fd5bd1fcb6eb795a98519e8a45551fd5e404b22eb3e118369cce35ea"
+      "sha256": "3a9d2a54bc76ea41d67b42be5f2c07da60fcdeec3bbed8f23111163dfa17f1ff"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11292,7 +11292,7 @@
     {
       "path": "tests/hub_recent_ships.mjs",
       "mode": "0000644",
-      "sha256": "53c7c8ad2de098d29c9010ed37e43779e8ceda4790018527c7edf45d54e56e80"
+      "sha256": "0d8f07c64f4d17c8c894b2d6395281882efd4e186c5714fe9aab61e2808d4314"
     },
     {
       "path": "tests/idea_capture_grades.mjs",
@@ -12032,12 +12032,12 @@
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
-      "sha256": "130672f5f844f2552f98bdc3e7b30fa9d49dd460e81c02a60c5684db6617f804"
+      "sha256": "d63e22b8ddbcbe7e21a59ee907e5a4261bebc067c52de111c32a88f97a172406"
     },
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "ef2a58d60f561da1e025cf0958bdcb66072545158a68f3e41b4bc683afbed9d6"
+      "sha256": "d70924dd2ddfc4e05c4b52d9763d76b0a68cf0ed16db6ffd1b07a1834bef0890"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",
@@ -13237,7 +13237,7 @@
     {
       "path": "tests/visible_projects_feed.mjs",
       "mode": "0000644",
-      "sha256": "a15bfe5f3b664a9daa4f45b80eb7a5bee2b2c630198439352c170fc44c4b2025"
+      "sha256": "8a8df7e2a025029ffe7e18b7c7b18c6bd92a256822609931f0cd88628e446041"
     },
     {
       "path": "tests/wandering_prefs.mjs",

package/docs/adr/0171-profile-rollup-join-and-consent.md

@@ -25,6 +25,8 @@ Five facts found during this spike shape the decisions:
 
 **2. One safe read path, enforced next to the data.** The port exposes `getPublicProfileExtras(githubId)`: `null` unless the account exists, is publicly addressable (Decision 3), and `hide_stats` is false — otherwise `{ totals: { projects, credits, works_shipped, karma }, disciplines, last_active, projects: [{ name, origin, rank_held }...], more_projects }`, whitelist-shaped **inside the module** (`client_id` and raw rows never cross the port; non-numeric `github_id` values like the `system:*` principals return `null` instead of hitting a bigint cast error). Every surface that shows cross-project numbers reads through the module's filtered functions at render time, never from a stored copy — and that includes the two that already exist: **`listScoutingRollup` itself gains the `profile_state = 'active' AND NOT hide_stats` predicate and a whitelisted projection**, so `/people` and `/scouting` (live today at Metic floor) honor hide by construction, not by memory. The hub hall profile, the `/u/<handle>` page, recruiting (R14/R15) and applications (R09) all sit on the same functions, which is what makes C2's "honored live everywhere, including pending applications" structural. Two deliberate side doors, both narrow: `getOwnProfileExtras(githubId)` serves the builder their own numbers regardless of flags (Settings), and spike 1002785's recruiter flow is expected to add a second **authorization-scoped** read for its opt-in discoverability sliver — `hide_stats` is the invariant every reader honors; public addressability is not.
 
+> **D2 amendment — which projects a profile may NAME (owner, 2026-09-16, task 1003558).** Until then a project was named only when `featured AND status = 'active'`, a predicate the public map dropped in R06 (ADR 0182 D3). It is now **on the map AND Public**: `onMapSql('p') AND p.visibility = 'public'`, where `onMapSql` is the feed's own fragment, so a profile and the map cannot disagree about who is on the map. `featured` gates no name. **Private is deliberately NOT named**, though its name is on the map: naming it on a profile publishes who works there, at what rank and on which works, which the map never says. Stealth stays unnamed (ADR 0182 D2a). Everything unnamed is counted in `more_projects`, and `recent_ships` follow the name.
+
 **3. Consent is a fail-closed `profile_state` on `platform_identity_accounts`, with one discriminator.** Migration `platform_identity_007_profile_consent.sql` (lands with R02) adds `profile_state text NOT NULL DEFAULT 'provisional' CHECK (profile_state IN ('provisional','active'))` and `hide_stats boolean NOT NULL DEFAULT false`. The single rule: **an account is `active` iff it was touched by a hub-session `/sso/authorize`** — the one path where a human is demonstrably at the hub (and where T&C acceptance can later be captured, task 1002913). Device-poll and check-in create `provisional`; the rollup endpoint creates nothing (orphan activity rows are never publicly addressable). Backfill: **all existing accounts start `provisional`** and lazily upgrade on their next hub-session authorize — no join to core `builders` (that join is type-unsafe against `system:*` text ids and would put a core-table read inside a module migration; the price is that existing hub builders' profiles publish on their next sign-in rather than immediately). Public surfaces read only `active` accounts. **R02 ships this fail-closed default without waiting on P03**, because the asymmetry only runs one way: P03 can then only ever *widen* exposure, never claw back something already published. This deliberately narrows the Phase-4 interview's "no extra consent gate" to the accounts whose consent premise actually holds; P03 is the owner either ratifying that boundary (recommended) or reverting to the interview decision verbatim — and the revert branch has a named precondition: check-in/device-created identities have **no self-serve hide path** (no hub builder session exists for them; hub admission is invite-gated), so rejecting P03 first requires an assertion-authenticated hide path or open hub enrollment. Task 1002799 carries this full decision payload.
 
 > **P03 outcome — RATIFIED (owner, 2026-08-16, task 1002799).** The fail-closed boundary stands: check-in/device-created accounts stay `provisional` (not publicly listed, not at `/u/<handle>`, not in the sitemap or hub search) until their human signs in at the hub at least once. The owner's rationale: in the intended product flow a builder passes through cloudbongos.com at least once anyway — to find or create the projects they join — so the activation gate is satisfied naturally and costs nothing; the cloudbongos builders hall predating the hub flow is a one-time bootstrap exception, and those accounts lazily activate on their next hub sign-in exactly as the backfill rule above already provides (no backfill activation). Tasks 1002913 (T&C artifact) and 1002914 (criterion text amendments) unblock on this ship.

package/docs/adr/0182-project-visibility-two-axes.md

@@ -169,7 +169,7 @@ The last sentence of this decision is therefore now spent — `stealth` unqualif
 - Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
 - **R16 makes D3's bound real, and D4's gate reach a second module.** Shipping R16 (task 1002335) surfaced one thing this ADR left implicit. D3 says `featured` may never put an unpublishable project on the map, so `PATCH /projects/:id/featured` now refuses a dark-matter row (409 `not_publishable`, `missing` in the details); un-featuring stays unconditional, since an already-featured husk must remain removable. And D4's "name what is missing" is owed to the owner *before* their project is ever catalogued on the hub — which is the `provisioning` plane, a different module that ADR 0083 forbids from importing `platform-identity`. Rather than let a two-field rule exist twice, the gate is published as a kernel seam port, `project.publishGate` (`modules/platform-identity/publish-gate.js`). `provisioning` resolves it **optionally** and declares no `consumes`: `platform-identity` is hub-only, the public map is a hub concept, and a platform without one must answer "no verdict" rather than invent a local rule — which is the same drift-avoidance argument that produced `publishableSql` in the first place.
 
-- **R06 landed the predicate swap and the redaction, and settled three things this ADR left to the implementer** (task 1002325, `modules/platform-identity/projects-feed.js`). (a) **A black hole carries no stable per-project key.** D2a lists `name`/`tagline`/`art_url`/`origin`, and an id looks harmless beside them — but any identifier that survives a state change lets an observer who kept yesterday's public feed diff it against today's and *name* the project that went stealth. So stealth rows are byte-identical to one another and the feed grew no public id at all; the orbs page keys by position. (b) **The redaction is an ALLOW-list, not a deny-list** — every key nulled except `state` and `orb` — so a column added to the feed later is anonymous without anyone remembering to come back to it, and it NULLS rather than deletes, keeping the feed's "never drop a key" contract. (c) **An unrecognised `visibility` draws as a black hole, not a planet**: this mapping is a privacy boundary, so a fourth enum value added without mapping it must fail closed. Two smaller notes: the route PATH keeps the word `featured` (it is rank:public and CORS-open, already fetched by a static site and other origins — renaming it would break them for nothing, and `ORDER BY featured DESC` is where the flag's D3 ranking job now lives); and `getRollupForBuilder`'s `is_public` was deliberately left on the OLD `featured AND active` predicate rather than widened with the feed, because a stealth project is on the map *anonymously* and naming it in a builder's profile would be the exact leak D2a forbids — how much of a cross-project record may be NAMED is ADR 0171 D2's question, and under-naming is the safe direction meanwhile.
+- **R06 landed the predicate swap and the redaction, and settled three things this ADR left to the implementer** (task 1002325, `modules/platform-identity/projects-feed.js`). (a) **A black hole carries no stable per-project key.** D2a lists `name`/`tagline`/`art_url`/`origin`, and an id looks harmless beside them — but any identifier that survives a state change lets an observer who kept yesterday's public feed diff it against today's and *name* the project that went stealth. So stealth rows are byte-identical to one another and the feed grew no public id at all; the orbs page keys by position. (b) **The redaction is an ALLOW-list, not a deny-list** — every key nulled except `state` and `orb` — so a column added to the feed later is anonymous without anyone remembering to come back to it, and it NULLS rather than deletes, keeping the feed's "never drop a key" contract. (c) **An unrecognised `visibility` draws as a black hole, not a planet**: this mapping is a privacy boundary, so a fourth enum value added without mapping it must fail closed. Two smaller notes: the route PATH keeps the word `featured` (it is rank:public and CORS-open, already fetched by a static site and other origins — renaming it would break them for nothing, and `ORDER BY featured DESC` is where the flag's D3 ranking job now lives); and `getRollupForBuilder`'s `is_public` was deliberately left on the OLD `featured AND active` predicate rather than widened with the feed, because a stealth project is on the map *anonymously* and naming it in a builder's profile would be the exact leak D2a forbids — how much of a cross-project record may be NAMED is ADR 0171 D2's question, and under-naming is the safe direction meanwhile. (Widened by task 1003558 to on-the-map AND Public; see the ADR 0171 D2 amendment.)
 
 ## Alternatives rejected
 

package/docs/module-api-changelog.md

@@ -2030,5 +2030,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.776 with no explicit bump. run 35137334438. (task 1002620)
   1.19.778 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.777 with no explicit bump. run 35139523999. (task 1002620)
+  1.19.779 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.778 with no explicit bump. run 35144678111. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/platform-identity.js

@@ -322,7 +322,7 @@ const {
 // D1/D2a/D3; R06, task 1002325). Its own file for the publish-gate.js reason: this
 // file is at the size ratchet. Re-exported below, so the surface is unchanged.
 const {
-  ORB_BY_STATE, orbForState, isStealthProject, feedShapeFor, listPublicProjects, PUBLIC_FEED_MAX_PAGE_SIZE,
+  ORB_BY_STATE, orbForState, isStealthProject, feedShapeFor, listPublicProjects, PUBLIC_FEED_MAX_PAGE_SIZE, onMapSql,
 } = require('./projects-feed');
 
 // Upsert a catalog row (keyed by origin). Called when a client registers (so every
@@ -753,17 +753,14 @@ function isNumericGithubId(githubId) {
 // listScoutingRollup's corrected shape: scalars over the UN-FANNED activity
 // table, the disciplines union computed separately (never a pre-GROUP-BY unnest
 // fan-out — bug task 1002911). Per-project rows join the module-internal
-// client_id → sso_clients.origin → projects.origin two-hop; a project is NAMED
-// only when its catalog row is publicly listed today (featured + active).
-// Everything else is counted in more_projects, never named ("the aggregate is
-// not the leak, the name is").
+// client_id → sso_clients.origin → projects.origin two-hop. Everything not
+// named is counted in more_projects ("the aggregate is not the leak, the name is").
 //
-// Deliberately NARROWER than the public feed since R06 (task 1002325), and left so
-// rather than widened here: a STEALTH project is on the map ANONYMOUSLY (ADR 0182
-// D2a), so naming it in a builder's profile would be the leak the feed exists to
-// prevent, and how much of a record may be NAMED is ADR 0171 D2's question, not
-// R06's. Narrower under-names, which is safe. The widening is its own task.
-// client_id never appears in the returned shape.
+// NAMED = on the map by the feed's own predicate (onMapSql) AND Public — the
+// owner's call on task 1003558 (ADR 0171 D2 amendment). A Private project is
+// named on the map but not here: who works there, their rank and their work
+// titles stay counted. Stealth is on the map anonymously (ADR 0182 D2a).
+// `featured` only ranks (D3), so it gates no name. client_id never crosses.
 async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
   const { rows: aggRows } = await pool.query(
@@ -790,7 +787,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   const agg = aggRows[0];
   const { rows: projRows } = await pool.query(
     `SELECT p.name, p.origin, a.rank_held, a.recent_ships,
-            (p.id IS NOT NULL AND p.featured AND p.status = 'active') AS is_public
+            (p.id IS NOT NULL AND ${onMapSql('p')} AND p.visibility = 'public') AS is_public
        FROM platform_identity_builder_project_activity a
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
        LEFT JOIN platform_identity_projects p ON p.origin = c.origin

package/modules/platform-identity/projects-feed.js

@@ -207,7 +207,20 @@ const PUBLIC_FEED_MAX_PAGE_SIZE = 500;
 // The same predicate written without the `visibility_source` half — or shipped without
 // migration 020's backfill, which stamps every pre-existing row 'control-plane' — would
 // empty the public map on deploy. Both halves are load-bearing.
-const DOOR_KNOWN_SQL = "(visibility_source = 'control-plane' OR visibility_reported_at IS NOT NULL)";
+function doorKnownSql(prefix = '') {
+  return `(${prefix}visibility_source = 'control-plane' OR ${prefix}visibility_reported_at IS NOT NULL)`;
+}
+const DOOR_KNOWN_SQL = doorKnownSql();
+
+// ON THE MAP, as one SQL fragment: active, publishable and door-known. The feed's WHERE
+// and a builder profile's naming rule (getRollupForBuilder, task 1003558) both read it,
+// so a profile can never name a project by a different idea of "on the map" than the map's.
+// publishableSql() refuses a non-identifier alias before this interpolates it too.
+function onMapSql(alias) {
+  const publishable = publishableSql(alias);
+  const prefix = alias ? `${alias}.` : '';
+  return `(${prefix}status = 'active' AND ${publishable} AND ${doorKnownSql(prefix)})`;
+}
 
 // Every project ON THE MAP, in the public projection (no owner_github_id, no status) — ONE
 // PAGE of it (task 1003561, which absorbed task 1003560). `visibility` is projected because
@@ -235,7 +248,7 @@ async function listPublicProjects({ pool = defaultPool, limit = PUBLIC_FEED_MAX_
   const { rows } = await pool.query(
     `SELECT origin, name, tagline, art_url, type, template, created_at, visibility
        FROM platform_identity_projects
-      WHERE status = 'active' AND ${publishableSql()} AND ${DOOR_KNOWN_SQL}
+      WHERE ${onMapSql()}
       ORDER BY ${IDENTIFIED_SQL} DESC,
                (${IDENTIFIED_SQL} AND featured) DESC,
                (CASE WHEN ${IDENTIFIED_SQL} THEN created_at END) DESC,
@@ -260,5 +273,6 @@ module.exports = {
   feedShapeFor,
   PUBLIC_FEED_MAX_PAGE_SIZE,
   DOOR_KNOWN_SQL,
+  onMapSql,
   listPublicProjects,
 };

package/modules/platform-identity/tests/platform-identity.mjs

@@ -18,6 +18,7 @@ import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const P = require('../platform-identity.js');
+const { onMapSql } = require('../projects-feed.js');
 const terms = require('../terms-acceptance.js');
 
 let passed = 0, failed = 0;
@@ -287,7 +288,7 @@ await ta('listPublicProjects returns a PUBLIC projection (on-the-map only, no ow
   // R06 (task 1002325) replaced the `featured = true` gate with the derived publish
   // gate: a project is on the map iff it is active AND publishable (ADR 0182 D3).
   // The full predicate + the stealth redaction are pinned by tests/visible_projects_feed.mjs.
-  assert.match(c.text, /WHERE status = 'active' AND /);
+  assert.match(c.text, /WHERE \(status = 'active' AND /);
   assert.ok(c.text.includes(P.publishableSql()), 'the map predicate is the shared gate');
   // Pin the SELECT LIST itself, not the whole query — an ORDER BY mention must
   // not satisfy a projection guard, and SELECT * must never sneak owner/status
@@ -681,6 +682,11 @@ await ta('getRollupForBuilder aggregates un-fanned + names only publicly-catalog
   const aggCte = aggSql.slice(aggSql.indexOf('WITH agg AS'), aggSql.indexOf('disc AS'));
   assert.doesNotMatch(aggCte, /unnest/i, 'scalar CTE must not fan rows out');
   assert.match(aggSql.slice(aggSql.indexOf('disc AS')), /array_agg\(DISTINCT x\.d\)/);
+  // WHO is named (task 1003558): on the map by the feed's own predicate AND Public.
+  const isPublic = (pool.calls[1].text.match(/\(p\.id IS NOT NULL[\s\S]*?\) AS is_public/) || [''])[0];
+  assert.ok(isPublic.includes(onMapSql('p')), 'names read the feed\'s on-the-map predicate, not a restatement');
+  assert.match(isPublic, /AND p\.visibility = 'public'\) AS is_public$/, 'Private and Stealth are counted, never named');
+  assert.doesNotMatch(isPublic, /featured/, 'featured only ranks the feed (ADR 0182 D3); it gates no name');
 });
 
 await ta('getPublicProfileExtras is fail-closed: null for missing / provisional / hidden accounts', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.778",
+  "version": "1.19.779",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.778",
+      "version": "1.19.779",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.778",
+  "version": "1.19.779",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.778'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.779'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_recent_ships.mjs

@@ -237,6 +237,19 @@ await t('getRollupForBuilder attaches recent_ships to publicly-named projects on
   assert.ok(!serialized.includes('SECRET-PROJECT'), 'nor does its name (the pre-existing rule this one follows)');
 });
 
+await t('works follow the NAME: the one statement that reads recent_ships names Public projects only (task 1003558)', async () => {
+  // A second, wider read of the works would let a Private project's titles out while
+  // its name stayed counted. So the works and the naming verdict must share a row.
+  const pool = mockPool((sql) => (/WITH agg AS/.test(sql)
+    ? { rows: [{ projects: 0, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null }] }
+    : { rows: [] }));
+  await pi.getRollupForBuilder(42, { pool });
+  const reads = pool.calls.filter((c) => /recent_ships/.test(c.text));
+  assert.equal(reads.length, 1, 'exactly one statement reads the works');
+  assert.match(reads[0].text, /AND p\.visibility = 'public'\) AS is_public/, 'and it decides the name on the same row');
+  assert.doesNotMatch(reads[0].text, /featured/, 'featured gates no name, so it gates no work either');
+});
+
 await t('a project that reported no works reads as an empty list, not null', async () => {
   const pool = mockPool((sql) => {
     if (/WITH agg AS/.test(sql)) return { rows: [{ projects: 1, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null }] };

package/tests/profile_rollup_consent.mjs

@@ -8,9 +8,10 @@
 //      /scouting by construction. Consent is TWO columns since ADR 0213
 //      (profile_state='active' AND terms_accepted_at IS NOT NULL), and the
 //      LEGACY fixture is the pre-terms row that proves the second one.
-//   2. getRollupForBuilder aggregates un-fanned and names ONLY projects whose
-//      catalog row is publicly listed (featured + active); everything else is
-//      counted in more_projects, never named. client_id never crosses.
+//   2. getRollupForBuilder aggregates un-fanned and names ONLY projects that are
+//      on the map AND Public (task 1003558) — featured or not; Private, Stealth
+//      and door-unknown rows are counted in more_projects, never named.
+//      client_id never crosses.
 //   3. getPublicProfileExtras is fail-closed (missing/provisional/hidden/
 //      non-numeric → null); getOwnProfileExtras serves the self view anyway.
 //   4. upsertAccount's consent upgrade is one-way (activate flips provisional →
@@ -53,15 +54,18 @@ try {
 const ACTIVE = 90002278, HIDDEN = 90002279, PROV = 90002280, LAZY = 90002281, LEGACY = 90002283;
 const ALL_IDS = [ACTIVE, HIDDEN, PROV, LAZY, LEGACY];
 const PUB_CLIENT = 't1002278-pub', PRIV_CLIENT = 't1002278-priv', LOST_CLIENT = 't1002278-lost';
-const ALL_CLIENTS = [PUB_CLIENT, PRIV_CLIENT, LOST_CLIENT];
+const STEALTH_CLIENT = 't1003558-stealth', UNREAD_CLIENT = 't1003558-unread';
+const ALL_CLIENTS = [PUB_CLIENT, PRIV_CLIENT, LOST_CLIENT, STEALTH_CLIENT, UNREAD_CLIENT];
 const PUB_ORIGIN = 'https://t1002278-pub.example', PRIV_ORIGIN = 'https://t1002278-priv.example';
+const STEALTH_ORIGIN = 'https://t1003558-stealth.example', UNREAD_ORIGIN = 'https://t1003558-unread.example';
+const ALL_ORIGINS = [PUB_ORIGIN, PRIV_ORIGIN, STEALTH_ORIGIN, UNREAD_ORIGIN];
 const q = (sql, params) => pool.query(sql, params);
 
 async function cleanup() {
   await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_project_memberships WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
-  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [ALL_ORIGINS]).catch(() => {});
   await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [ALL_CLIENTS]).catch(() => {});
 }
 
@@ -75,12 +79,20 @@ try {
   // (012), and the consent floor tests terms_accepted_at (019). Without them a
   // FRESH database answers 42703 "column does not exist" — an infrastructure
   // error dressed up as a boundary failure — instead of a clean assertion.
+  // 011 and 020 carry the columns the naming rule reads (description, visibility,
+  // the door-known pair); 012_recent_ships the column the rollup SELECTs; 008 and
+  // 009 the handle and display_name_source columns upsertAccount writes.
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_004_projects.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
   await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
+  await q(migrationSql('platform_identity_020_visibility_pull.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND
@@ -96,27 +108,39 @@ try {
             ($4, 'legacy-b', 'Legacy', 'active', false, NULL)`,
     [ACTIVE, HIDDEN, PROV, LEGACY],
   );
-  // Three reporting projects: one publicly catalogued (featured+active), one
-  // catalogued but NOT featured (→ never named), one with no catalog row at all.
+  // Five reporting projects (task 1003558). All but Lost are active and described;
+  // only Pub is on the map AND Public — and it is the one that is NOT featured, so
+  // the old `featured` gate would name exactly the wrong rows:
+  //   Pub     public,  unfeatured, door assigned  → named
+  //   Priv    private, featured,   door assigned  → counted
+  //   Stealth stealth, featured,   door assigned  → counted
+  //   Unread  public,  featured,   door never read → counted (dark matter)
+  //   Lost    no catalog row at all              → counted
   await q(
     `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
-     VALUES ($1, 'x', 'Pub Proj', $4), ($2, 'x', 'Priv Proj', $5), ($3, 'x', 'Lost Proj', NULL)`,
-    [...ALL_CLIENTS, PUB_ORIGIN, PRIV_ORIGIN],
+     VALUES ($1, 'x', 'Pub Proj', $6), ($2, 'x', 'Priv Proj', $7), ($3, 'x', 'Lost Proj', NULL),
+            ($4, 'x', 'Stealth Proj', $8), ($5, 'x', 'Unread Proj', $9)`,
+    [...ALL_CLIENTS, ...ALL_ORIGINS],
   );
   await q(
-    `INSERT INTO platform_identity_projects (origin, name, featured, status)
-     VALUES ($1, 'Pub Proj', true, 'active'), ($2, 'Priv Proj', false, 'active')`,
-    [PUB_ORIGIN, PRIV_ORIGIN],
+    `INSERT INTO platform_identity_projects (origin, name, description, featured, status, visibility, visibility_source)
+     VALUES ($1, 'Pub Proj',     'described', false, 'active', 'public',  'control-plane'),
+            ($2, 'Priv Proj',    'described', true,  'active', 'private', 'control-plane'),
+            ($3, 'Stealth Proj', 'described', true,  'active', 'stealth', 'control-plane'),
+            ($4, 'Unread Proj',  'described', true,  'active', 'public',  NULL)`,
+    ALL_ORIGINS,
   );
   await q(
     `INSERT INTO platform_identity_builder_project_activity
        (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
-     VALUES ($1, $4, 100, 5, 3, 'metic',  '{engineer,ui}', '2026-01-01T00:00:00Z'),
-            ($2, $4,  50, 2, 1, 'archon', '{artist}',      '2026-02-01T00:00:00Z'),
-            ($3, $4,  25, 1, 0, NULL,     '{}',            '2026-03-01T00:00:00Z'),
-            ($1, $5,  60, 4, 2, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z'),
-            ($1, $6,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z'),
-            ($1, $7,  90, 3, 1, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z')`,
+     VALUES ($1, $6, 100, 5, 3, 'metic',  '{engineer,ui}', '2026-01-01T00:00:00Z'),
+            ($2, $6,  50, 2, 1, 'archon', '{artist}',      '2026-02-01T00:00:00Z'),
+            ($3, $6,  25, 1, 0, NULL,     '{}',            '2026-03-01T00:00:00Z'),
+            ($4, $6,   0, 0, 0, 'thetes', '{}',            '2025-12-01T00:00:00Z'),
+            ($5, $6,   0, 0, 0, 'thetes', '{}',            '2025-12-01T00:00:00Z'),
+            ($1, $7,  60, 4, 2, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z'),
+            ($1, $8,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z'),
+            ($1, $9,  90, 3, 1, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z')`,
     [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV, LEGACY],
   );
 
@@ -133,18 +157,20 @@ try {
 
   // 2 — getRollupForBuilder semantics.
   const r = await pi.getRollupForBuilder(ACTIVE, { pool });
-  assert.deepEqual(r.totals, { projects: 3, credits: 175, works_shipped: 8, karma: 4 });
+  assert.deepEqual(r.totals, { projects: 5, credits: 175, works_shipped: 8, karma: 4 });
   pass++; console.log('  ok - totals aggregate un-fanned across the builder\'s projects');
   assert.deepEqual([...r.disciplines].sort(), ['artist', 'engineer', 'ui']);
   pass++; console.log('  ok - disciplines are the deduped union');
   ok(new Date(r.last_active).toISOString() === '2026-03-01T00:00:00.000Z', 'last_active is the max');
-  ok(r.projects.length === 1 && r.projects[0].name === 'Pub Proj', 'only the publicly-catalogued project is named');
-  assert.deepEqual(Object.keys(r.projects[0]).sort(), ['name', 'origin', 'rank_held']);
-  pass++; console.log('  ok - named rows carry exactly name/origin/rank_held');
+  ok(r.projects.length === 1 && r.projects[0].name === 'Pub Proj', 'only the on-the-map Public project is named — unfeatured, and named anyway');
+  assert.deepEqual(Object.keys(r.projects[0]).sort(), ['name', 'origin', 'rank_held', 'recent_ships']);
+  pass++; console.log('  ok - named rows carry exactly name/origin/rank_held/recent_ships');
   ok(r.projects[0].rank_held === 'metic', 'rank_held is that project\'s reported standing');
-  ok(r.more_projects === 2, 'unfeatured + uncatalogued projects are counted, never named');
+  ok(r.more_projects === 4, 'Private, Stealth, door-unknown and uncatalogued projects are counted, never named');
   ok(!JSON.stringify(r).includes('client_id'), 'client_id never crosses the shape');
-  ok(!JSON.stringify(r).includes('Priv Proj'), 'a non-public project name never crosses');
+  for (const unnamed of ['Priv Proj', 'Stealth Proj', 'Unread Proj', PRIV_ORIGIN, STEALTH_ORIGIN, UNREAD_ORIGIN]) {
+    ok(!JSON.stringify(r).includes(unnamed), `"${unnamed}" never crosses`);
+  }
 
   // 3 — the port reads.
   ok(await pi.getPublicProfileExtras(HIDDEN, { pool }) === null, 'public read → null for a hidden builder');

package/tests/profile_route.mjs

@@ -345,16 +345,37 @@ const HIDDEN_LOGIN = 'hidden-DO-NOT-LEAK-r06';
 const PROV_LOGIN = 'provisional-DO-NOT-LEAK-r06';
 const PRIVATE_LOGIN = 'private-DO-NOT-LEAK-r06';
 
-// TWO projects — one publicly catalogued, one not. Distinctive digits so the
-// "no partial numbers" scan below cannot pass by coincidence.
+// TWO projects, both on the map — one Public and UNFEATURED, one Private and
+// FEATURED — so neither the old `featured` gate nor a door-blind one passes
+// (task 1003558). Distinctive digits so the "no partial numbers" scan below
+// cannot pass by coincidence.
+const ON_MAP = { status: 'active', description: 'described', visibility_source: 'control-plane', visibility_reported_at: null };
 const PROOF_PROJECTS = [
   { name: 'R06 Public Proj', origin: 'https://r06-pub.example', rank_held: 'metic',
-    credits: 60271, tasks_shipped: 4103, karma: 9021, is_public: true },
+    credits: 60271, tasks_shipped: 4103, karma: 9021, catalog: { ...ON_MAP, visibility: 'public', featured: false } },
   { name: SECRET_PROJECT_NAME, origin: 'https://r06-priv.example', rank_held: 'archon',
-    credits: 40129, tasks_shipped: 2011, karma: 3007, is_public: false },
+    credits: 40129, tasks_shipped: 2011, karma: 3007, catalog: { ...ON_MAP, visibility: 'private', featured: true } },
 ];
 const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
 
+// getRollupForBuilder's `is_public`, evaluated the scouting engine's way: a catalog
+// row is named unless a predicate the SQL actually DECLARES refuses it. Drop
+// `p.visibility = 'public'` from the module and the Private project gets named here.
+function namedByDeclaredSql(sql, project) {
+  const expr = (sql.match(/\(p\.id IS NOT NULL[\s\S]*?\) AS is_public/) || [''])[0];
+  const c = { name: project.name, ...project.catalog };
+  const declared = [
+    [/p\.featured/, c.featured === true],
+    [/p\.status = 'active'/, c.status === 'active'],
+    [/coalesce\(p\.name, ''\)\) <> ''/, String(c.name ?? '').trim() !== ''],
+    [/coalesce\(p\.description, ''\)\) <> ''/, String(c.description ?? '').trim() !== ''],
+    [/p\.visibility_source = 'control-plane' OR p\.visibility_reported_at IS NOT NULL/,
+      c.visibility_source === 'control-plane' || c.visibility_reported_at != null],
+    [/p\.visibility = 'public'/, c.visibility === 'public'],
+  ];
+  return expr !== '' && declared.every(([re, holds]) => !re.test(expr) || holds);
+}
+
 // The one account row the reads consult. setAccountHideStats mutates it.
 // ADR 0213 (task 1002913): consent is profile_state AND an acceptance of the
 // platform terms, both stamped by the same upsertAccount branch.
@@ -415,7 +436,8 @@ const engine = {
     }
     // getRollupForBuilder's per-project rows (the client_id → origin two-hop).
     if (/platform_identity_sso_clients/.test(sql)) {
-      return { rows: PROOF_PROJECTS.map((p) => ({ name: p.name, origin: p.origin, rank_held: p.rank_held, is_public: p.is_public, recent_ships: [] })) };
+      return { rows: PROOF_PROJECTS.map((p) => ({ name: p.name, origin: p.origin, rank_held: p.rank_held,
+        is_public: namedByDeclaredSql(sql, p), recent_ships: [] })) };
     }
     // getRollupForBuilder's un-fanned aggregate — summed ACROSS both projects.
     if (/AS works_shipped/.test(sql)) {
@@ -460,9 +482,38 @@ await t('R06.1 a two-project builder\'s COMBINED record shows to another account
   assert.equal(cp.totals.works_shipped, sumOf('tasks_shipped'), 'ships are summed across both');
   assert.equal(cp.totals.karma, sumOf('karma'), 'karma is summed across both');
   assert.deepEqual(cp.disciplines, ['engineer', 'ui'], 'the disciplines union spans both projects');
-  assert.equal(cp.projects.length, 1, 'only the publicly-catalogued project is NAMED');
+  assert.equal(cp.projects.length, 1, 'only the Public project is NAMED — unfeatured, and named anyway');
   assert.equal(cp.projects[0].name, PROOF_PROJECTS[0].name);
-  assert.equal(cp.more_projects, 1, 'the other is counted, never named');
+  assert.equal(cp.more_projects, 1, 'the Private one is counted, never named — featured, and unnamed anyway');
+});
+
+await t('R06.1 a name needs the map AND the Public door — every other shape is counted, never named (task 1003558)', async () => {
+  const [pub, other] = PROOF_PROJECTS;
+  const original = other.catalog;
+  const unnamed = {
+    private: { ...original, visibility: 'private' },
+    stealth: { ...original, visibility: 'stealth' },
+    'public, door never read': { ...original, visibility: 'public', visibility_source: null, visibility_reported_at: null },
+    'public, no description (dark matter)': { ...original, visibility: 'public', description: '  ' },
+    'public, hidden from the catalog': { ...original, visibility: 'public', status: 'hidden' },
+  };
+  try {
+    for (const [label, catalog] of Object.entries(unnamed)) {
+      other.catalog = catalog;
+      const r = await get(port, '/api/gds/builders/95/profile');
+      const cp = r.json.cross_project;
+      assert.deepEqual(cp.projects.map((p) => p.name), [pub.name], `${label}: only the Public project is named`);
+      assert.equal(cp.more_projects, 1, `${label}: counted`);
+      assert.ok(!r.text.includes(SECRET_PROJECT_NAME) && !r.text.includes(other.origin), `${label}: neither its name nor its origin crosses`);
+    }
+    // The positive control: the same row IS named once Public and on the map, so the
+    // refusals above are the door, not a fixture nothing could ever name.
+    other.catalog = { ...original, visibility: 'public' };
+    const r = await get(port, '/api/gds/builders/95/profile');
+    assert.deepEqual(r.json.cross_project.projects.map((p) => p.name), [pub.name, SECRET_PROJECT_NAME]);
+  } finally {
+    other.catalog = original;
+  }
 });
 
 await t('R06.1 the record is viewer-INDEPENDENT — another account sees the same body', async () => {

package/tests/visible_projects_feed.mjs

@@ -463,7 +463,9 @@ test('dark matter never reaches the route at all — the exclusion is in SQL', a
   const src = require('node:fs').readFileSync(
     new URL('../modules/platform-identity/projects-feed.js', import.meta.url), 'utf8');
   const fn = (src.match(/async function listPublicProjects[\s\S]*?\n\}/) || [''])[0];
-  assert.ok(fn.includes('publishableSql()'), 'the gate is applied in the query, not after it');
+  assert.ok(fn.includes('onMapSql()'), 'the gate is applied in the query, not after it');
+  const feed = require('../modules/platform-identity/projects-feed.js');
+  assert.ok(feed.onMapSql().includes(pi.publishableSql()), 'and on-the-map carries the publish gate');
 });
 
 // ── the route's half of the page window (task 1003560 → 1003561) ─────────────