@bongos/core 1.20.18 → 1.20.20

package/tests/activity_rollup_order_db.mjs

@@ -0,0 +1,131 @@
+// tests/activity_rollup_order_db.mjs — task 1004268 (real DB).
+//
+// A rollup report computed EARLIER never overwrites one computed LATER. The
+// instance stamps each report with the moment it read the totals (the
+// Bongos-Report-As-Of header, carried here as upsertActivity's `asOf`), and the
+// live row's ON CONFLICT DO UPDATE only fires when the incoming stamp is at least
+// the stored one. Before this, a sign-in report and a ship report racing to the
+// hub were last-writer-wins, so the older totals could commit last and the
+// leaderboard would read a regression that never happened.
+//
+// Only a real Postgres can settle this: the guard is a WHERE on the conflict
+// branch, and what it does with NULLs (a report from an instance too old to stamp,
+// a row written before the column existed) and with a skipped update (does the
+// snapshot beside it still agree with the live row?) is planner behaviour, not
+// statement shape.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_rollup_order_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_rollup_order_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const ORDER = 90042681, LEGACY = 90042682, FUTURE = 90042683, RACE = 90042684;
+const IDS = [ORDER, LEGACY, FUTURE, RACE];
+const CLIENT = 't1004268-client';
+const q = (sql, params) => pool.query(sql, params);
+const report = (githubId, credits, asOf) =>
+  pi.upsertActivity({ clientId: CLIENT, githubId, credits, tasksShipped: 1, karma: 0, asOf }, { pool });
+const at = (sec) => new Date(Date.UTC(2026, 8, 30, 12, 0, sec)).toISOString();
+
+async function cleanup() {
+  await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+}
+async function live(githubId) {
+  const { rows } = await q(
+    `SELECT credits, reported_as_of FROM platform_identity_builder_project_activity
+      WHERE client_id = $1 AND github_id = $2`, [CLIENT, githubId]);
+  return rows[0];
+}
+async function newestSnapshot(githubId) {
+  const { rows } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at DESC, id DESC LIMIT 1`, [CLIENT, githubId]);
+  return rows[0] ? rows[0].credits : null;
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of ['platform_identity_005_builder_activity.sql', 'platform_identity_012_recent_ships.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql']) {
+    await q(migrationSql(f));
+  }
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql')); // idempotent: replays cleanly
+  await cleanup();
+
+  // 1 — the race the task describes, landed in the bad order.
+  await report(ORDER, 200, at(20)); // the ship report, computed later, lands first
+  await report(ORDER, 100, at(10)); // the sign-in report, computed earlier, lands last
+  same((await live(ORDER)).credits, 200, 'an older report landing last does not overwrite the newer totals');
+  same(await newestSnapshot(ORDER), 200, 'and the snapshot history does not record the regression either');
+  await report(ORDER, 300, at(30));
+  same((await live(ORDER)).credits, 300, 'a genuinely newer report still applies');
+  await report(ORDER, 250, at(30));
+  same((await live(ORDER)).credits, 250, 'an equal stamp applies (ties go to the later arrival, as before)');
+
+  // 2 — mixed versions. An instance too old to stamp sends no as_of: last-writer-wins,
+  // exactly as before, and it clears the guard rather than leaving a stamp its numbers
+  // no longer match.
+  await report(LEGACY, 10, null);
+  same((await live(LEGACY)).reported_as_of, null, 'an unstamped report stores no stamp');
+  await report(LEGACY, 20, at(10));
+  same((await live(LEGACY)).credits, 20, 'a stamped report over an unstamped row applies');
+  await report(LEGACY, 5, null);
+  same([(await live(LEGACY)).credits, (await live(LEGACY)).reported_as_of], [5, null],
+    'an unstamped report always applies and clears the stamp (the old behaviour, for old instances)');
+  await report(LEGACY, 30, at(1));
+  same((await live(LEGACY)).credits, 30, 'after it, the next stamped report applies whatever its stamp');
+
+  // 3 — a sender whose clock runs ahead cannot freeze the row: a stamp past the hub's
+  // own now() is stored as now(), so the next honest report is not refused until then.
+  await report(FUTURE, 1, new Date(Date.now() + 365 * 86400e3).toISOString());
+  const stored = new Date((await live(FUTURE)).reported_as_of).getTime();
+  ok(stored <= Date.now() + 1000, 'a future stamp is clamped to the hub clock');
+  await report(FUTURE, 2, new Date(Date.now() + 2000).toISOString());
+  same((await live(FUTURE)).credits, 2, 'so the next report from a correct clock still applies');
+
+  // 4 — racing writers: the row lock queues them, and whatever the commit order the
+  // row ends on the report with the LATEST stamp, and the newest snapshot agrees.
+  for (let round = 0; round < 10; round++) {
+    await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = $1', [RACE]);
+    await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = $1', [RACE]);
+    const stamps = [1, 2, 3, 4, 5].sort(() => Math.random() - 0.5);
+    await Promise.all(stamps.map((s) => report(RACE, s * 100, at(s))));
+    const row = await live(RACE);
+    assert.equal(row.credits, 500, `round ${round}: the row ended on ${row.credits}, not the latest-stamped 500`);
+    assert.equal(await newestSnapshot(RACE), 500, `round ${round}: the newest snapshot disagrees with the live row`);
+  }
+  pass++; console.log('  ok - 10 rounds of five racing reports in random order: the latest stamp always wins');
+
+  console.log(`\nactivity_rollup_order_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/activity_snapshots_db.mjs

@@ -97,6 +97,8 @@ try {
   // column); without it here, the upsertActivity steps fail 42703 on a fresh database.
   await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (task 1004268) — same reason as 012 above.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // 1 — the writer snapshots the LIVE row, and only when it changed.

package/tests/guild_totals.mjs

@@ -0,0 +1,183 @@
+// tests/guild_totals.mjs — a guild's collective record (R26, task 1002302; ADR
+// 0337 D4.4, superseding ADR 0336 D5).
+//
+// DB-free. What it holds, each easy to lose in a later edit without anything else
+// going red:
+//
+//   1. THE BAND SCALE. 1-2-5 from 10, the band floor published, 0 below the first
+//      band — exact numbers never reach a row.
+//   2. THE NAMED CONSTANTS are the ADR's: k = 3, a 7-day refresh.
+//   3. THE COMPUTATION COMPOSES THE SHARED PREDICATES (accountActiveSql for who may
+//      count at all, rollupVisibleSql for who is public) and never restates them;
+//      only public members' named public projects enter the project count.
+//   4. THE WEEKLY GATE IS IN THE WRITE ITSELF, and the read is a bare SELECT.
+//   5. THE POLLER IS REGISTERED and a failed sweep never throws.
+//
+// The rules that only a real planner can settle (who is counted, when k flips,
+// the padding case, the upsert's age guard) are proved in tests/guild_totals_db.mjs.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const gt = require('../modules/platform-identity/guild-totals.js');
+const poller = require('../modules/platform-identity/pollers/guild-totals.js');
+const { accountActiveSql, rollupVisibleSql } = require('../modules/platform-identity/account-visibility.js');
+const { onMapSql } = require('../modules/platform-identity/projects-feed.js');
+
+// A pool that records every statement and answers from a queue.
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      const next = queue.shift();
+      if (next instanceof Error) return Promise.reject(next);
+      return Promise.resolve(next || { rows: [], rowCount: 0 });
+    },
+  };
+}
+
+// ── 1. The band scale ──
+
+test('bandFloor publishes the 1-2-5 band floor from 10, and 0 below it', () => {
+  const cases = [
+    [0, 0], [1, 0], [9, 0], [9.99, 0],
+    [10, 10], [19, 10], [20, 20], [49, 20], [50, 50], [99, 50],
+    [100, 100], [199, 100], [200, 200], [499, 200], [500, 500], [999, 500],
+    [1000, 1000], [2500, 2000], [7777, 5000], [12345, 10000],
+  ];
+  for (const [n, want] of cases) assert.equal(gt.bandFloor(n), want, `bandFloor(${n})`);
+});
+
+test('bandFloor never publishes more than it was given, and fails closed on junk', () => {
+  for (const n of [-50, -1, NaN, undefined, null, 'abc', Infinity]) {
+    assert.equal(gt.bandFloor(n), 0, `bandFloor(${String(n)}) is 0`);
+  }
+  // Postgres hands sums back as strings; the scale reads them the same.
+  assert.equal(gt.bandFloor('1234'), 1000);
+  // The columns are integer: a floor never exceeds what they can hold.
+  assert.equal(gt.bandFloor(5e12), 2000000000);
+  for (let n = 0; n < 5000; n += 7) assert.ok(gt.bandFloor(n) <= n);
+});
+
+// ── 2. The named constants ──
+
+test('the constants are the ADR\'s own numbers', () => {
+  assert.equal(gt.NON_PUBLIC_MIN_COUNTED, 3, 'k = 3 (ADR 0337 D4.4)');
+  assert.equal(gt.TOTALS_REFRESH_DAYS, 7, 'at most weekly');
+  assert.deepEqual(gt.TOTALS_BAND_MANTISSAS, [1, 2, 5]);
+  assert.equal(gt.TOTALS_FIRST_BAND, 10);
+});
+
+// ── 3. The computation ──
+
+test('who counts is composed from the shared predicates, never restated', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await gt.computeGuildSums(['7', '8'], { pool });
+  const { text, params } = pool.calls[0];
+  assert.ok(text.includes(accountActiveSql('pa')), 'an un-consented account never counts');
+  assert.ok(text.includes(`(gm.shown_publicly AND ${rollupVisibleSql('pa')}) AS is_public`),
+    'public = shown on this guild\'s page AND the account\'s own record is public');
+  assert.match(text, /AND gm\.counted_in_totals/, 'the per-guild switch is honoured');
+  assert.match(text, /WHERE m\.is_public OR k\.non_public >= \$2/,
+    'non-public numbers enter only at or above k');
+  assert.deepEqual(params, [['7', '8'], 3], 'k is bound from the named constant');
+});
+
+test('only public members\' named public projects enter the project count', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await gt.computeGuildSums(['7'], { pool });
+  const projs = pool.calls[0].text.split('projs AS')[1];
+  assert.ok(projs.includes(`WHERE c.is_public AND ${onMapSql('p')} AND p.visibility = 'public'`),
+    'ADR 0336 D5\'s union rule: never a non-public member\'s projects, never a non-public project');
+  assert.match(projs, /count\(DISTINCT p\.id\)/, 'a project two members share counts once');
+});
+
+test('an empty batch asks the database nothing', async () => {
+  const pool = recordingPool();
+  assert.deepEqual(await gt.computeGuildSums([], { pool }), []);
+  assert.equal(pool.calls.length, 0);
+});
+
+// ── 4. The weekly gate, and a read that only reads ──
+
+test('refresh stores band floors only, and re-asserts the week in its own upsert', async () => {
+  const pool = recordingPool([
+    { rows: [{ id: '7' }, { id: '8' }] },
+    { rows: [
+      { guild_id: '7', credits: '1234', works_shipped: '57', karma: '-3', projects: '2' },
+      { guild_id: '8', credits: '0', works_shipped: '0', karma: '0', projects: '0' },
+    ] },
+    { rows: [], rowCount: 2 },
+  ]);
+  const out = await gt.refreshStaleGuildTotals({ limit: 50 }, { pool });
+  assert.deepEqual(out, { scanned: 2, refreshed: 2 });
+
+  const [pick, , upsert] = pool.calls;
+  assert.match(pick.text, /t\.guild_id IS NULL OR t\.computed_at <= now\(\) - make_interval\(days => \$1::int\)/,
+    'due = never computed, or at least a week old');
+  assert.match(pick.text, /ORDER BY t\.computed_at ASC NULLS FIRST/, 'stalest first');
+  assert.deepEqual(pick.params, [7, 50]);
+
+  assert.match(upsert.text, /ON CONFLICT \(guild_id\) DO UPDATE[\s\S]*WHERE t\.computed_at <= now\(\) - make_interval\(days => \$6::int\)/,
+    'a racing sweep cannot refresh a guild twice in a week');
+  assert.match(upsert.text, /WHERE EXISTS \(SELECT 1 FROM platform_identity_guilds g WHERE g\.id = u\.guild_id\)/,
+    'a guild dissolved mid-sweep is skipped, not an FK failure for the batch');
+  assert.deepEqual(upsert.params, [['7', '8'], [1000, 0], [50, 0], [0, 0], [0, 0], 7],
+    'only band floors are written — 1234 credits is stored as 1000, never 1234');
+});
+
+test('nothing due → no computation and no write', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.deepEqual(await gt.refreshStaleGuildTotals({}, { pool }), { scanned: 0, refreshed: 0 });
+  assert.equal(pool.calls.length, 1);
+});
+
+test('the read is one SELECT of the stored record, and null before the first refresh', async () => {
+  const at = new Date('2026-09-28T00:00:00Z');
+  const pool = recordingPool([
+    { rows: [{ credits: 1000, works_shipped: 50, karma: 0, projects: 2, computed_at: at }] },
+    { rows: [] },
+  ]);
+  assert.deepEqual(await gt.readGuildTotals('7', { pool }),
+    { credits: 1000, works_shipped: 50, karma: 0, projects: 2, as_of: at });
+  assert.equal(await gt.readGuildTotals('8', { pool }), null);
+  for (const c of pool.calls) {
+    assert.match(c.text.trim(), /^SELECT credits, works_shipped, karma, projects, computed_at\s+FROM platform_identity_guild_totals\s+WHERE guild_id = \$1$/);
+  }
+});
+
+test('the migration stores no exact sum and no member count', () => {
+  const sql = readFileSync(new URL('../modules/platform-identity/migrations/platform_identity_027_guild_totals.sql', import.meta.url), 'utf8');
+  const table = sql.split('CREATE TABLE IF NOT EXISTS platform_identity_guild_totals (')[1].split(');')[0];
+  const cols = table.split('\n').map((l) => l.trim().split(/\s+/)[0]).filter((c) => /^[a-z_]+$/.test(c));
+  assert.deepEqual(cols, ['guild_id', 'credits', 'works_shipped', 'karma', 'projects', 'computed_at'],
+    'a counted-member count, or a flag saying non-public numbers are in, would reveal how many non-public members a guild has');
+  assert.match(table, /REFERENCES platform_identity_guilds\(id\) ON DELETE CASCADE/, 'a dissolved guild takes its record with it');
+});
+
+// ── 5. The poller ──
+
+test('the poller is registered on the module and is hourly, with the weekly limit per row', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/platform-identity/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('guild-totals'));
+  assert.equal(poller.SWEEP_INTERVAL_MS, 60 * 60 * 1000);
+  assert.equal(typeof poller.start, 'function');
+  assert.equal(typeof poller.stop, 'function');
+});
+
+test('a failed sweep is logged and swallowed, never thrown', async () => {
+  const pool = recordingPool([new Error('db down')]);
+  assert.equal(await poller.sweepOnce({ pool }), null);
+});
+
+test('a sweep hands the injected pool through', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.deepEqual(await poller.sweepOnce({ pool }), { scanned: 0, refreshed: 0 });
+  assert.equal(pool.calls.length, 1);
+});

package/tests/guild_totals_db.mjs

@@ -0,0 +1,292 @@
+// tests/guild_totals_db.mjs — a guild's collective record against REAL SQL
+// (R26, task 1002302; ADR 0337 D4.4).
+//
+// Why a real database: who is counted is a join over three predicates and a
+// FILTERed count, the k gate is a CTE comparison, and the weekly limit is a WHERE
+// on an upsert's conflict branch — whose re-evaluation against the row a racing
+// writer just committed only a real Postgres settles. The DB-free sibling,
+// tests/guild_totals.mjs, holds the band scale and the statement shapes.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r26-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guild_totals_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guild_totals_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const gt = require('../modules/platform-identity/guild-totals.js');
+const guilds = require('../modules/platform-identity/guilds.js');
+
+// The cast. Credits are powers of two where it matters, so every exact sum below
+// names exactly which members went into it.
+const OWN = 9002302001;    // public, shown — the guild's owner
+const PUB = 9002302002;    // public, shown
+const HID1 = 9002302003;   // hides their numbers
+const HID2 = 9002302004;   // hides their numbers
+const HID3 = 9002302005;   // hides their numbers
+const PRIV = 9002302006;   // private account
+const UNSHOWN = 9002302007; // public account, not shown on this guild's page
+const OFF = 9002302008;    // public, shown, switched counting OFF
+const PROV = 9002302009;   // provisional — never consented
+const FAKE1 = 9002302010;  // the padding case: private, numbers the owner knows
+const FAKE2 = 9002302011;
+const TARGET = 9002302012; // hides their numbers
+const ALL_IDS = [OWN, PUB, HID1, HID2, HID3, PRIV, UNSHOWN, OFF, PROV, FAKE1, FAKE2, TARGET];
+
+const CLIENT_A = 'r26-client-a';  // → a public project on the map
+const CLIENT_B = 'r26-client-b';  // → another public project on the map
+const CLIENT_C = 'r26-client-c';  // → a PRIVATE project
+const ORIGIN = { [CLIENT_A]: 'https://r26-a.example', [CLIENT_B]: 'https://r26-b.example', [CLIENT_C]: 'https://r26-c.example' };
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin LIKE 'https://r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id LIKE 'r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+async function account(id, handle, { visibility = 'public', hide = false, state = 'active' } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility, hide_stats)
+     VALUES ($1, $2, $2, $2, $3, CASE WHEN $3 = 'active' THEN now() END, $4, $5)`,
+    [id, handle, state, visibility, hide],
+  );
+}
+async function activity(id, client, credits, ships = 0, karma = 0) {
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [client, id, credits, ships, karma],
+  );
+}
+async function guild(slug, visibility = 'public') {
+  const { rows } = await q(
+    `INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ($1, $1, $2) RETURNING id::text AS id`,
+    [slug, visibility],
+  );
+  return rows[0].id;
+}
+async function member(gid, id, { kind = 'member', shown = true, counted = true } = {}) {
+  await q(
+    `INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly, counted_in_totals)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [gid, id, kind, shown, counted],
+  );
+}
+const sums = async (gid) => {
+  const [r] = await gt.computeGuildSums([gid], { pool });
+  return { credits: Number(r.credits), works_shipped: Number(r.works_shipped), karma: Number(r.karma), projects: Number(r.projects) };
+};
+const stored = async (gid) => (await q(
+  `SELECT credits, works_shipped, karma, projects, computed_at FROM platform_identity_guild_totals WHERE guild_id = $1`, [gid],
+)).rows[0] || null;
+const backdate = (gid, days) => q(
+  `UPDATE platform_identity_guild_totals SET computed_at = now() - make_interval(days => $2::int) WHERE guild_id = $1`, [gid, days],
+);
+// Only this file's guilds: a shared DB may hold other guilds the sweep would also pick.
+const refresh = () => gt.refreshStaleGuildTotals({ limit: 500 }, { pool });
+
+try {
+  // Every table the computation reads, all idempotent: accounts + consent, handle,
+  // privacy, terms; clients, projects, their visibility and the door stamp; the
+  // activity rollup; guilds; and this task's snapshot table.
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_004_projects.sql',
+    'platform_identity_005_builder_activity.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_011_project_visibility.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_020_visibility_pull.sql', 'platform_identity_025_guilds.sql',
+    'platform_identity_027_guild_totals.sql',
+  ]) await q(migrationSql(f));
+  await q(migrationSql('platform_identity_027_guild_totals.sql')); // re-runnable
+  await cleanup();
+
+  await account(OWN, 'r26own');
+  await account(PUB, 'r26pub');
+  await account(HID1, 'r26hid1', { hide: true });
+  await account(HID2, 'r26hid2', { hide: true });
+  await account(HID3, 'r26hid3', { hide: true });
+  await account(PRIV, 'r26priv', { visibility: 'private' });
+  await account(UNSHOWN, 'r26unshown');
+  await account(OFF, 'r26off');
+  await account(PROV, 'r26prov', { state: 'provisional' });
+  await account(FAKE1, 'r26fake1', { visibility: 'private' });
+  await account(FAKE2, 'r26fake2', { visibility: 'private' });
+  await account(TARGET, 'r26target', { hide: true });
+
+  for (const c of [CLIENT_A, CLIENT_B, CLIENT_C]) {
+    await q(`INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin) VALUES ($1, 'x', $1, $2)`, [c, ORIGIN[c]]);
+  }
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, description, visibility, visibility_source)
+     VALUES ($1, 'A', 'a public project', 'public', 'control-plane'),
+            ($2, 'B', 'another public project', 'public', 'control-plane'),
+            ($3, 'C', 'a private project', 'private', 'control-plane')`,
+    [ORIGIN[CLIENT_A], ORIGIN[CLIENT_B], ORIGIN[CLIENT_C]],
+  );
+
+  await activity(OWN, CLIENT_A, 1, 1, 1);
+  await activity(OWN, CLIENT_C, 2, 1, 1);     // a public member on a private project
+  await activity(PUB, CLIENT_A, 4, 1, 1);     // shares project A with OWN
+  await activity(HID1, CLIENT_B, 8, 1, 1);    // the only builder on project B
+  await activity(HID2, CLIENT_A, 16, 1, 1);
+  await activity(HID3, CLIENT_A, 32, 1, 1);
+  await activity(PRIV, CLIENT_A, 64, 1, 1);
+  await activity(UNSHOWN, CLIENT_A, 128, 1, 1);
+  await activity(OFF, CLIENT_A, 256, 1, 1);
+  await activity(PROV, CLIENT_A, 512, 1, 1);
+
+  // --- 1. who is counted, and the k gate (ADR 0337 D4.4) --------------------
+  const g1 = await guild('r26-one');
+  await member(g1, OWN, { kind: 'owner' });
+  await member(g1, PUB);
+  await member(g1, HID1);
+  await member(g1, HID2);
+  await member(g1, OFF, { counted: false });
+  await member(g1, PROV);
+  same((await sums(g1)).credits, 1 + 2 + 4,
+    'two counted non-public members (< k) → the totals add up the public members alone; OFF and PROV never count');
+
+  await member(g1, HID3);
+  same((await sums(g1)).credits, 1 + 2 + 4 + 8 + 16 + 32,
+    'a third counted non-public member reaches k = 3 → every counted member\'s numbers enter');
+  same((await sums(g1)).works_shipped, 6, 'works shipped sums over the same members\' rows (OWN has two)');
+
+  const g2 = await guild('r26-two');
+  await member(g2, OWN, { kind: 'owner' });
+  await member(g2, PRIV);
+  await member(g2, UNSHOWN, { shown: false });
+  await member(g2, HID1);
+  same((await sums(g2)).credits, 1 + 2 + 64 + 128 + 8,
+    'a private account and a member not shown on the page are non-public too, and count toward k');
+  await q(`UPDATE platform_identity_guild_members SET counted_in_totals = false WHERE guild_id = $1 AND github_id = $2`, [g2, PRIV]);
+  same((await sums(g2)).credits, 1 + 2,
+    'one member switching off drops them AND can drop the guild below k, taking every non-public number out');
+
+  // --- 2. projects: public members, named public projects, distinct ---------
+  same((await sums(g1)).projects, 1,
+    'project A once (OWN and PUB share it); never private project C; never HID1\'s project B, even with k met');
+
+  // --- 3. the stored record: band floors only, and a read that only reads ----
+  same(await guilds.getPublicGuild('r26-one', { pool }).then((r) => r.totals), null,
+    'before the first refresh the public read carries no totals — and computes none');
+  same(await stored(g1), null, 'a public read wrote nothing');
+
+  await refresh();
+  const first = await stored(g1);
+  same({ credits: first.credits, works_shipped: first.works_shipped, karma: first.karma, projects: first.projects },
+    { credits: 50, works_shipped: 0, karma: 0, projects: 0 },
+    '63 credits is stored as its band floor 50; 6 works and 6 karma are under the first band (0)');
+  const pub = await guilds.getPublicGuild('r26-one', { pool });
+  same(pub.totals, { credits: 50, works_shipped: 0, karma: 0, projects: 0, as_of: first.computed_at },
+    'the public read publishes the stored band floors and when they were computed');
+  same(pub.size, 6,
+    'size stays the public roster\'s length: OWN, PUB, OFF and the three who hide their numbers (hide_stats hides numbers, never the name — ADR 0336 D4 §2); never PROV');
+
+  // --- 4. at most weekly -----------------------------------------------------
+  await activity(OWN, CLIENT_B, 1000);
+  for (let i = 0; i < 5; i++) await guilds.getPublicGuild('r26-one', { pool });
+  await refresh();
+  same((await stored(g1)).credits, 50,
+    'a change inside the week moves nothing: not five reads, not another sweep');
+
+  await backdate(g1, 6);
+  await refresh();
+  same((await stored(g1)).credits, 50, 'six days old is still inside the week');
+
+  await backdate(g1, 7);
+  const [a, b] = await Promise.all([refresh(), refresh()]);
+  same((await stored(g1)).credits, 1000, 'a week old → refreshed: 1063 credits is now the 1000 band');
+  const racedG1 = [a, b].filter((r) => r.refreshed > 0).length;
+  ok(racedG1 >= 1, 'at least one sweep refreshed the due guild');
+  const oneRow = await q(`SELECT count(*)::int AS n FROM platform_identity_guild_totals WHERE guild_id = $1`, [g1]);
+  same(oneRow.rows[0].n, 1, 'one row per guild');
+
+  // The upsert's own guard, without the pick step's help: a sweep that picked the
+  // guild while it was due, and lost the race to one that committed first, must
+  // update nothing. The wrapper plays the winning sweep between this one's pick
+  // and its write.
+  await backdate(g1, 7);
+  const losingPool = {
+    async query(text, params) {
+      const out = await pool.query(text, params);
+      if (/LEFT JOIN platform_identity_guild_totals t ON t\.guild_id = g\.id/.test(text)) {
+        await q(`UPDATE platform_identity_guild_totals SET credits = 20, computed_at = now() WHERE guild_id = $1`, [g1]);
+      }
+      return out;
+    },
+  };
+  await gt.refreshStaleGuildTotals({ limit: 500 }, { pool: losingPool });
+  same((await stored(g1)).credits, 20,
+    'the age check lives in the write: the losing sweep leaves the winner\'s record alone');
+
+  // --- 5. unlisted, and dissolve --------------------------------------------
+  const g3 = await guild('r26-quiet', 'unlisted');
+  await member(g3, OWN, { kind: 'owner', shown: false });
+  await refresh();
+  ok(!!(await stored(g3)), 'an unlisted guild has a record too (ready for a flip to public)…');
+  same(await guilds.getPublicGuild('r26-quiet', { pool }), null, '…but no public read reaches it');
+  await q(`DELETE FROM platform_identity_guilds WHERE id = $1`, [g3]);
+  same(await stored(g3), null, 'dissolving a guild takes its record with it (FK cascade)');
+
+  // --- 6. the honest limit, DOCUMENTED, not fixed (ADR 0337 D4.4) -----------
+  // A guild owner who pads with two accounts whose numbers they already know
+  // makes a real non-public member the third, and the total then carries that
+  // member. Accepted by the owner on 2026-09-25: the notice on the join card and
+  // the per-guild switch are the defence, not this computation. If this block
+  // ever goes red because the padding stopped working, the rule changed — update
+  // ADR 0337 D4.4 before this test.
+  await activity(TARGET, CLIENT_A, 777);
+  const own = 1 + 2 + 1000; // OWN's three rows, after section 4's report
+  const pad = await guild('r26-pad');
+  await member(pad, OWN, { kind: 'owner' });
+  await member(pad, FAKE1);
+  await member(pad, FAKE2);
+  same((await sums(pad)).credits, own, 'the two fakes alone are below k');
+  await member(pad, TARGET);
+  same((await sums(pad)).credits, own + 777,
+    'PADDING WORKS (accepted): the target becomes the third non-public member and enters the sum');
+  await q(`UPDATE platform_identity_guild_members SET counted_in_totals = false WHERE guild_id = $1 AND github_id = $2`, [pad, TARGET]);
+  same((await sums(pad)).credits, own, 'the target\'s answer is the switch: off, and they are out');
+
+  // --- 7. karma below zero stays inside the column's floor ------------------
+  const neg = await guild('r26-neg');
+  await member(neg, PUB, { kind: 'owner' });
+  await q(`UPDATE platform_identity_builder_project_activity SET karma = -40 WHERE github_id = $1`, [PUB]);
+  await refresh();
+  same((await stored(neg)).karma, 0, 'a negative sum publishes as 0, never below the CHECK');
+
+  console.log(`\nguild_totals_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/guilds_api.mjs

@@ -263,8 +263,13 @@ test('public read: the roster is shown_publicly AND the shared existence predica
   });
   const res = await call('GET', '/api/bongos/guilds/Guild-A');
   assert.equal(res.status, 200);
-  assert.deepEqual(Object.keys(res.json).sort(), ['guild', 'members', 'size']);
+  assert.deepEqual(Object.keys(res.json).sort(), ['guild', 'members', 'size', 'totals']);
   assert.equal(res.json.size, 2);
+  assert.equal(res.json.totals, null, 'no stored record yet → no totals, never a computed stand-in');
+  assert.ok(calls.some((c) => /FROM platform_identity_guild_totals\s+WHERE guild_id = \$1/.test(c.text)),
+    'the totals are READ from the weekly snapshot');
+  assert.ok(calls.every((c) => !/INSERT|UPDATE|platform_identity_builder_project_activity/.test(c.text)),
+    'the public read never computes or writes the totals (ADR 0337 D4.4: never on a read)');
   assert.equal(res.json.members.length, 2);
   assert.ok(!('id' in res.json.guild), 'the row id stays internal');
   assert.ok(!/github_id|github_login/.test(res.text), 'no account id or login crosses');

package/tests/profile_rollup_consent.mjs

@@ -100,6 +100,8 @@ try {
   // before the fixtures, so its one-shot grandfather never sees LEGACY below.
   await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (026, task 1004268): 42703 without it.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND