@bongos/core 1.20.19 → 1.20.21

package/tests/guild_map_db.mjs

@@ -0,0 +1,157 @@
+// tests/guild_map_db.mjs — the guild map against REAL SQL (R30, task 1002306;
+// ADR 0336 D8, amended by ADR 0337 D4.4).
+//
+// Why a real database: who is listed is an INNER join to an aggregated roster,
+// size is a capped count under the shared existence predicate, and the shipped
+// ordering puts un-refreshed guilds (NULL) last — each a planner fact the
+// DB-free route test (tests/guilds_api.mjs §3b) can only assert the shape of.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r30-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guild_map_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guild_map_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const guildMap = require('../modules/platform-identity/guild-map.js');
+const guilds = require('../modules/platform-identity/guilds.js');
+
+const A = 9002306001;    // public
+const B = 9002306002;    // public
+const C = 9002306003;    // public
+const HID = 9002306004;  // public account, hides their numbers
+const PRIV = 9002306005; // private account
+const PROV = 9002306006; // provisional
+const ALL_IDS = [A, B, C, HID, PRIV, PROV];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r30-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+async function account(id, handle, { visibility = 'public', hide = false, state = 'active' } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility, hide_stats)
+     VALUES ($1, $2, $2, $2, $3, CASE WHEN $3 = 'active' THEN now() END, $4, $5)`,
+    [id, handle, state, visibility, hide],
+  );
+}
+async function guild(slug, visibility = 'public') {
+  const { rows } = await q(
+    `INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ($1, $1, $2) RETURNING id`,
+    [slug, visibility],
+  );
+  return rows[0].id;
+}
+async function member(gid, id, { kind = 'member', shown = true } = {}) {
+  await q(
+    `INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly)
+     VALUES ($1, $2, $3, $4)`,
+    [gid, id, kind, shown],
+  );
+}
+const totals = (gid, shipped) => q(
+  `INSERT INTO platform_identity_guild_totals (guild_id, credits, works_shipped, karma, projects)
+   VALUES ($1, 0, $2, 0, 0)`, [gid, shipped],
+);
+// Only this file's guilds: a shared DB may hold others.
+const mine = async (order) => (await guildMap.listGuildMap({ order, limit: 100 }, { pool }))
+  .results.filter((r) => r.slug.startsWith('r30-'));
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_019_terms_acceptance.sql', 'platform_identity_025_guilds.sql',
+    'platform_identity_027_guild_totals.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  await account(A, 'r30a');
+  await account(B, 'r30b');
+  await account(C, 'r30c');
+  await account(HID, 'r30hid', { hide: true });
+  await account(PRIV, 'r30priv', { visibility: 'private' });
+  await account(PROV, 'r30prov', { state: 'provisional' });
+
+  // r30-big: three public members, one who hides numbers (still shown), one private (never).
+  const big = await guild('r30-big');
+  await member(big, A, { kind: 'owner' });
+  await member(big, B);
+  await member(big, HID);
+  await member(big, PRIV);
+  await totals(big, 20);
+  // r30-alpha / r30-beta: two each, a size tie broken on slug; beta has no record yet.
+  const alpha = await guild('r30-alpha');
+  await member(alpha, A, { kind: 'owner' });
+  await member(alpha, C);
+  await totals(alpha, 50);
+  const beta = await guild('r30-beta');
+  await member(beta, B, { kind: 'owner' });
+  await member(beta, C);
+  // r30-gamma: same shipped band as big (tie on shipped → slug).
+  const gamma = await guild('r30-gamma');
+  await member(gamma, C, { kind: 'owner' });
+  await totals(gamma, 20);
+  // Never on the map: unlisted; a public guild whose only members are private,
+  // provisional or unshown.
+  const quiet = await guild('r30-quiet', 'unlisted');
+  await member(quiet, A, { kind: 'owner', shown: false });
+  await member(quiet, B, { shown: false });
+  const hollow = await guild('r30-hollow');
+  await member(hollow, PRIV, { kind: 'owner' });
+  await member(hollow, PROV);
+  await member(hollow, A, { shown: false });
+
+  same((await mine('size')).map((r) => [r.slug, r.size]),
+    [['r30-big', 3], ['r30-alpha', 2], ['r30-beta', 2], ['r30-gamma', 1]],
+    'size order: public roster length, slug tiebreak; the hidden member counts, the private one never; unlisted and empty-roster guilds absent');
+  same((await mine('shipped')).map((r) => [r.slug, r.shipped]),
+    [['r30-alpha', 50], ['r30-big', 20], ['r30-gamma', 20], ['r30-beta', null]],
+    'shipped order: the stored band floor, slug tiebreak, a guild with no record yet last');
+
+  const page = await guilds.getPublicGuild('r30-big', { pool });
+  same((await mine('size')).find((r) => r.slug === 'r30-big').size, page.size,
+    'the map\'s size is exactly the guild page\'s size');
+
+  // Hides beat the map on the very next read: B goes private.
+  await q(`UPDATE platform_identity_accounts SET account_visibility = 'private' WHERE github_id = $1`, [B]);
+  same((await mine('size')).map((r) => [r.slug, r.size]),
+    [['r30-alpha', 2], ['r30-big', 2], ['r30-beta', 1], ['r30-gamma', 1]],
+    'a member going private leaves every guild\'s size on the next read — nothing cached');
+
+  same(Object.keys((await mine('size'))[0]).sort(), ['name', 'shipped', 'size', 'slug'],
+    'a row carries only what it publishes');
+
+  console.log(`\nguild_map_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/guild_totals.mjs

@@ -0,0 +1,183 @@
+// tests/guild_totals.mjs — a guild's collective record (R26, task 1002302; ADR
+// 0337 D4.4, superseding ADR 0336 D5).
+//
+// DB-free. What it holds, each easy to lose in a later edit without anything else
+// going red:
+//
+//   1. THE BAND SCALE. 1-2-5 from 10, the band floor published, 0 below the first
+//      band — exact numbers never reach a row.
+//   2. THE NAMED CONSTANTS are the ADR's: k = 3, a 7-day refresh.
+//   3. THE COMPUTATION COMPOSES THE SHARED PREDICATES (accountActiveSql for who may
+//      count at all, rollupVisibleSql for who is public) and never restates them;
+//      only public members' named public projects enter the project count.
+//   4. THE WEEKLY GATE IS IN THE WRITE ITSELF, and the read is a bare SELECT.
+//   5. THE POLLER IS REGISTERED and a failed sweep never throws.
+//
+// The rules that only a real planner can settle (who is counted, when k flips,
+// the padding case, the upsert's age guard) are proved in tests/guild_totals_db.mjs.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const gt = require('../modules/platform-identity/guild-totals.js');
+const poller = require('../modules/platform-identity/pollers/guild-totals.js');
+const { accountActiveSql, rollupVisibleSql } = require('../modules/platform-identity/account-visibility.js');
+const { onMapSql } = require('../modules/platform-identity/projects-feed.js');
+
+// A pool that records every statement and answers from a queue.
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      const next = queue.shift();
+      if (next instanceof Error) return Promise.reject(next);
+      return Promise.resolve(next || { rows: [], rowCount: 0 });
+    },
+  };
+}
+
+// ── 1. The band scale ──
+
+test('bandFloor publishes the 1-2-5 band floor from 10, and 0 below it', () => {
+  const cases = [
+    [0, 0], [1, 0], [9, 0], [9.99, 0],
+    [10, 10], [19, 10], [20, 20], [49, 20], [50, 50], [99, 50],
+    [100, 100], [199, 100], [200, 200], [499, 200], [500, 500], [999, 500],
+    [1000, 1000], [2500, 2000], [7777, 5000], [12345, 10000],
+  ];
+  for (const [n, want] of cases) assert.equal(gt.bandFloor(n), want, `bandFloor(${n})`);
+});
+
+test('bandFloor never publishes more than it was given, and fails closed on junk', () => {
+  for (const n of [-50, -1, NaN, undefined, null, 'abc', Infinity]) {
+    assert.equal(gt.bandFloor(n), 0, `bandFloor(${String(n)}) is 0`);
+  }
+  // Postgres hands sums back as strings; the scale reads them the same.
+  assert.equal(gt.bandFloor('1234'), 1000);
+  // The columns are integer: a floor never exceeds what they can hold.
+  assert.equal(gt.bandFloor(5e12), 2000000000);
+  for (let n = 0; n < 5000; n += 7) assert.ok(gt.bandFloor(n) <= n);
+});
+
+// ── 2. The named constants ──
+
+test('the constants are the ADR\'s own numbers', () => {
+  assert.equal(gt.NON_PUBLIC_MIN_COUNTED, 3, 'k = 3 (ADR 0337 D4.4)');
+  assert.equal(gt.TOTALS_REFRESH_DAYS, 7, 'at most weekly');
+  assert.deepEqual(gt.TOTALS_BAND_MANTISSAS, [1, 2, 5]);
+  assert.equal(gt.TOTALS_FIRST_BAND, 10);
+});
+
+// ── 3. The computation ──
+
+test('who counts is composed from the shared predicates, never restated', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await gt.computeGuildSums(['7', '8'], { pool });
+  const { text, params } = pool.calls[0];
+  assert.ok(text.includes(accountActiveSql('pa')), 'an un-consented account never counts');
+  assert.ok(text.includes(`(gm.shown_publicly AND ${rollupVisibleSql('pa')}) AS is_public`),
+    'public = shown on this guild\'s page AND the account\'s own record is public');
+  assert.match(text, /AND gm\.counted_in_totals/, 'the per-guild switch is honoured');
+  assert.match(text, /WHERE m\.is_public OR k\.non_public >= \$2/,
+    'non-public numbers enter only at or above k');
+  assert.deepEqual(params, [['7', '8'], 3], 'k is bound from the named constant');
+});
+
+test('only public members\' named public projects enter the project count', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await gt.computeGuildSums(['7'], { pool });
+  const projs = pool.calls[0].text.split('projs AS')[1];
+  assert.ok(projs.includes(`WHERE c.is_public AND ${onMapSql('p')} AND p.visibility = 'public'`),
+    'ADR 0336 D5\'s union rule: never a non-public member\'s projects, never a non-public project');
+  assert.match(projs, /count\(DISTINCT p\.id\)/, 'a project two members share counts once');
+});
+
+test('an empty batch asks the database nothing', async () => {
+  const pool = recordingPool();
+  assert.deepEqual(await gt.computeGuildSums([], { pool }), []);
+  assert.equal(pool.calls.length, 0);
+});
+
+// ── 4. The weekly gate, and a read that only reads ──
+
+test('refresh stores band floors only, and re-asserts the week in its own upsert', async () => {
+  const pool = recordingPool([
+    { rows: [{ id: '7' }, { id: '8' }] },
+    { rows: [
+      { guild_id: '7', credits: '1234', works_shipped: '57', karma: '-3', projects: '2' },
+      { guild_id: '8', credits: '0', works_shipped: '0', karma: '0', projects: '0' },
+    ] },
+    { rows: [], rowCount: 2 },
+  ]);
+  const out = await gt.refreshStaleGuildTotals({ limit: 50 }, { pool });
+  assert.deepEqual(out, { scanned: 2, refreshed: 2 });
+
+  const [pick, , upsert] = pool.calls;
+  assert.match(pick.text, /t\.guild_id IS NULL OR t\.computed_at <= now\(\) - make_interval\(days => \$1::int\)/,
+    'due = never computed, or at least a week old');
+  assert.match(pick.text, /ORDER BY t\.computed_at ASC NULLS FIRST/, 'stalest first');
+  assert.deepEqual(pick.params, [7, 50]);
+
+  assert.match(upsert.text, /ON CONFLICT \(guild_id\) DO UPDATE[\s\S]*WHERE t\.computed_at <= now\(\) - make_interval\(days => \$6::int\)/,
+    'a racing sweep cannot refresh a guild twice in a week');
+  assert.match(upsert.text, /WHERE EXISTS \(SELECT 1 FROM platform_identity_guilds g WHERE g\.id = u\.guild_id\)/,
+    'a guild dissolved mid-sweep is skipped, not an FK failure for the batch');
+  assert.deepEqual(upsert.params, [['7', '8'], [1000, 0], [50, 0], [0, 0], [0, 0], 7],
+    'only band floors are written — 1234 credits is stored as 1000, never 1234');
+});
+
+test('nothing due → no computation and no write', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.deepEqual(await gt.refreshStaleGuildTotals({}, { pool }), { scanned: 0, refreshed: 0 });
+  assert.equal(pool.calls.length, 1);
+});
+
+test('the read is one SELECT of the stored record, and null before the first refresh', async () => {
+  const at = new Date('2026-09-28T00:00:00Z');
+  const pool = recordingPool([
+    { rows: [{ credits: 1000, works_shipped: 50, karma: 0, projects: 2, computed_at: at }] },
+    { rows: [] },
+  ]);
+  assert.deepEqual(await gt.readGuildTotals('7', { pool }),
+    { credits: 1000, works_shipped: 50, karma: 0, projects: 2, as_of: at });
+  assert.equal(await gt.readGuildTotals('8', { pool }), null);
+  for (const c of pool.calls) {
+    assert.match(c.text.trim(), /^SELECT credits, works_shipped, karma, projects, computed_at\s+FROM platform_identity_guild_totals\s+WHERE guild_id = \$1$/);
+  }
+});
+
+test('the migration stores no exact sum and no member count', () => {
+  const sql = readFileSync(new URL('../modules/platform-identity/migrations/platform_identity_027_guild_totals.sql', import.meta.url), 'utf8');
+  const table = sql.split('CREATE TABLE IF NOT EXISTS platform_identity_guild_totals (')[1].split(');')[0];
+  const cols = table.split('\n').map((l) => l.trim().split(/\s+/)[0]).filter((c) => /^[a-z_]+$/.test(c));
+  assert.deepEqual(cols, ['guild_id', 'credits', 'works_shipped', 'karma', 'projects', 'computed_at'],
+    'a counted-member count, or a flag saying non-public numbers are in, would reveal how many non-public members a guild has');
+  assert.match(table, /REFERENCES platform_identity_guilds\(id\) ON DELETE CASCADE/, 'a dissolved guild takes its record with it');
+});
+
+// ── 5. The poller ──
+
+test('the poller is registered on the module and is hourly, with the weekly limit per row', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/platform-identity/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('guild-totals'));
+  assert.equal(poller.SWEEP_INTERVAL_MS, 60 * 60 * 1000);
+  assert.equal(typeof poller.start, 'function');
+  assert.equal(typeof poller.stop, 'function');
+});
+
+test('a failed sweep is logged and swallowed, never thrown', async () => {
+  const pool = recordingPool([new Error('db down')]);
+  assert.equal(await poller.sweepOnce({ pool }), null);
+});
+
+test('a sweep hands the injected pool through', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  assert.deepEqual(await poller.sweepOnce({ pool }), { scanned: 0, refreshed: 0 });
+  assert.equal(pool.calls.length, 1);
+});

package/tests/guild_totals_db.mjs

@@ -0,0 +1,292 @@
+// tests/guild_totals_db.mjs — a guild's collective record against REAL SQL
+// (R26, task 1002302; ADR 0337 D4.4).
+//
+// Why a real database: who is counted is a join over three predicates and a
+// FILTERed count, the k gate is a CTE comparison, and the weekly limit is a WHERE
+// on an upsert's conflict branch — whose re-evaluation against the row a racing
+// writer just committed only a real Postgres settles. The DB-free sibling,
+// tests/guild_totals.mjs, holds the band scale and the statement shapes.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r26-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guild_totals_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guild_totals_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const gt = require('../modules/platform-identity/guild-totals.js');
+const guilds = require('../modules/platform-identity/guilds.js');
+
+// The cast. Credits are powers of two where it matters, so every exact sum below
+// names exactly which members went into it.
+const OWN = 9002302001;    // public, shown — the guild's owner
+const PUB = 9002302002;    // public, shown
+const HID1 = 9002302003;   // hides their numbers
+const HID2 = 9002302004;   // hides their numbers
+const HID3 = 9002302005;   // hides their numbers
+const PRIV = 9002302006;   // private account
+const UNSHOWN = 9002302007; // public account, not shown on this guild's page
+const OFF = 9002302008;    // public, shown, switched counting OFF
+const PROV = 9002302009;   // provisional — never consented
+const FAKE1 = 9002302010;  // the padding case: private, numbers the owner knows
+const FAKE2 = 9002302011;
+const TARGET = 9002302012; // hides their numbers
+const ALL_IDS = [OWN, PUB, HID1, HID2, HID3, PRIV, UNSHOWN, OFF, PROV, FAKE1, FAKE2, TARGET];
+
+const CLIENT_A = 'r26-client-a';  // → a public project on the map
+const CLIENT_B = 'r26-client-b';  // → another public project on the map
+const CLIENT_C = 'r26-client-c';  // → a PRIVATE project
+const ORIGIN = { [CLIENT_A]: 'https://r26-a.example', [CLIENT_B]: 'https://r26-b.example', [CLIENT_C]: 'https://r26-c.example' };
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin LIKE 'https://r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id LIKE 'r26-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+async function account(id, handle, { visibility = 'public', hide = false, state = 'active' } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility, hide_stats)
+     VALUES ($1, $2, $2, $2, $3, CASE WHEN $3 = 'active' THEN now() END, $4, $5)`,
+    [id, handle, state, visibility, hide],
+  );
+}
+async function activity(id, client, credits, ships = 0, karma = 0) {
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [client, id, credits, ships, karma],
+  );
+}
+async function guild(slug, visibility = 'public') {
+  const { rows } = await q(
+    `INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ($1, $1, $2) RETURNING id::text AS id`,
+    [slug, visibility],
+  );
+  return rows[0].id;
+}
+async function member(gid, id, { kind = 'member', shown = true, counted = true } = {}) {
+  await q(
+    `INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly, counted_in_totals)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [gid, id, kind, shown, counted],
+  );
+}
+const sums = async (gid) => {
+  const [r] = await gt.computeGuildSums([gid], { pool });
+  return { credits: Number(r.credits), works_shipped: Number(r.works_shipped), karma: Number(r.karma), projects: Number(r.projects) };
+};
+const stored = async (gid) => (await q(
+  `SELECT credits, works_shipped, karma, projects, computed_at FROM platform_identity_guild_totals WHERE guild_id = $1`, [gid],
+)).rows[0] || null;
+const backdate = (gid, days) => q(
+  `UPDATE platform_identity_guild_totals SET computed_at = now() - make_interval(days => $2::int) WHERE guild_id = $1`, [gid, days],
+);
+// Only this file's guilds: a shared DB may hold other guilds the sweep would also pick.
+const refresh = () => gt.refreshStaleGuildTotals({ limit: 500 }, { pool });
+
+try {
+  // Every table the computation reads, all idempotent: accounts + consent, handle,
+  // privacy, terms; clients, projects, their visibility and the door stamp; the
+  // activity rollup; guilds; and this task's snapshot table.
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_004_projects.sql',
+    'platform_identity_005_builder_activity.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_011_project_visibility.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_020_visibility_pull.sql', 'platform_identity_025_guilds.sql',
+    'platform_identity_027_guild_totals.sql',
+  ]) await q(migrationSql(f));
+  await q(migrationSql('platform_identity_027_guild_totals.sql')); // re-runnable
+  await cleanup();
+
+  await account(OWN, 'r26own');
+  await account(PUB, 'r26pub');
+  await account(HID1, 'r26hid1', { hide: true });
+  await account(HID2, 'r26hid2', { hide: true });
+  await account(HID3, 'r26hid3', { hide: true });
+  await account(PRIV, 'r26priv', { visibility: 'private' });
+  await account(UNSHOWN, 'r26unshown');
+  await account(OFF, 'r26off');
+  await account(PROV, 'r26prov', { state: 'provisional' });
+  await account(FAKE1, 'r26fake1', { visibility: 'private' });
+  await account(FAKE2, 'r26fake2', { visibility: 'private' });
+  await account(TARGET, 'r26target', { hide: true });
+
+  for (const c of [CLIENT_A, CLIENT_B, CLIENT_C]) {
+    await q(`INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin) VALUES ($1, 'x', $1, $2)`, [c, ORIGIN[c]]);
+  }
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, description, visibility, visibility_source)
+     VALUES ($1, 'A', 'a public project', 'public', 'control-plane'),
+            ($2, 'B', 'another public project', 'public', 'control-plane'),
+            ($3, 'C', 'a private project', 'private', 'control-plane')`,
+    [ORIGIN[CLIENT_A], ORIGIN[CLIENT_B], ORIGIN[CLIENT_C]],
+  );
+
+  await activity(OWN, CLIENT_A, 1, 1, 1);
+  await activity(OWN, CLIENT_C, 2, 1, 1);     // a public member on a private project
+  await activity(PUB, CLIENT_A, 4, 1, 1);     // shares project A with OWN
+  await activity(HID1, CLIENT_B, 8, 1, 1);    // the only builder on project B
+  await activity(HID2, CLIENT_A, 16, 1, 1);
+  await activity(HID3, CLIENT_A, 32, 1, 1);
+  await activity(PRIV, CLIENT_A, 64, 1, 1);
+  await activity(UNSHOWN, CLIENT_A, 128, 1, 1);
+  await activity(OFF, CLIENT_A, 256, 1, 1);
+  await activity(PROV, CLIENT_A, 512, 1, 1);
+
+  // --- 1. who is counted, and the k gate (ADR 0337 D4.4) --------------------
+  const g1 = await guild('r26-one');
+  await member(g1, OWN, { kind: 'owner' });
+  await member(g1, PUB);
+  await member(g1, HID1);
+  await member(g1, HID2);
+  await member(g1, OFF, { counted: false });
+  await member(g1, PROV);
+  same((await sums(g1)).credits, 1 + 2 + 4,
+    'two counted non-public members (< k) → the totals add up the public members alone; OFF and PROV never count');
+
+  await member(g1, HID3);
+  same((await sums(g1)).credits, 1 + 2 + 4 + 8 + 16 + 32,
+    'a third counted non-public member reaches k = 3 → every counted member\'s numbers enter');
+  same((await sums(g1)).works_shipped, 6, 'works shipped sums over the same members\' rows (OWN has two)');
+
+  const g2 = await guild('r26-two');
+  await member(g2, OWN, { kind: 'owner' });
+  await member(g2, PRIV);
+  await member(g2, UNSHOWN, { shown: false });
+  await member(g2, HID1);
+  same((await sums(g2)).credits, 1 + 2 + 64 + 128 + 8,
+    'a private account and a member not shown on the page are non-public too, and count toward k');
+  await q(`UPDATE platform_identity_guild_members SET counted_in_totals = false WHERE guild_id = $1 AND github_id = $2`, [g2, PRIV]);
+  same((await sums(g2)).credits, 1 + 2,
+    'one member switching off drops them AND can drop the guild below k, taking every non-public number out');
+
+  // --- 2. projects: public members, named public projects, distinct ---------
+  same((await sums(g1)).projects, 1,
+    'project A once (OWN and PUB share it); never private project C; never HID1\'s project B, even with k met');
+
+  // --- 3. the stored record: band floors only, and a read that only reads ----
+  same(await guilds.getPublicGuild('r26-one', { pool }).then((r) => r.totals), null,
+    'before the first refresh the public read carries no totals — and computes none');
+  same(await stored(g1), null, 'a public read wrote nothing');
+
+  await refresh();
+  const first = await stored(g1);
+  same({ credits: first.credits, works_shipped: first.works_shipped, karma: first.karma, projects: first.projects },
+    { credits: 50, works_shipped: 0, karma: 0, projects: 0 },
+    '63 credits is stored as its band floor 50; 6 works and 6 karma are under the first band (0)');
+  const pub = await guilds.getPublicGuild('r26-one', { pool });
+  same(pub.totals, { credits: 50, works_shipped: 0, karma: 0, projects: 0, as_of: first.computed_at },
+    'the public read publishes the stored band floors and when they were computed');
+  same(pub.size, 6,
+    'size stays the public roster\'s length: OWN, PUB, OFF and the three who hide their numbers (hide_stats hides numbers, never the name — ADR 0336 D4 §2); never PROV');
+
+  // --- 4. at most weekly -----------------------------------------------------
+  await activity(OWN, CLIENT_B, 1000);
+  for (let i = 0; i < 5; i++) await guilds.getPublicGuild('r26-one', { pool });
+  await refresh();
+  same((await stored(g1)).credits, 50,
+    'a change inside the week moves nothing: not five reads, not another sweep');
+
+  await backdate(g1, 6);
+  await refresh();
+  same((await stored(g1)).credits, 50, 'six days old is still inside the week');
+
+  await backdate(g1, 7);
+  const [a, b] = await Promise.all([refresh(), refresh()]);
+  same((await stored(g1)).credits, 1000, 'a week old → refreshed: 1063 credits is now the 1000 band');
+  const racedG1 = [a, b].filter((r) => r.refreshed > 0).length;
+  ok(racedG1 >= 1, 'at least one sweep refreshed the due guild');
+  const oneRow = await q(`SELECT count(*)::int AS n FROM platform_identity_guild_totals WHERE guild_id = $1`, [g1]);
+  same(oneRow.rows[0].n, 1, 'one row per guild');
+
+  // The upsert's own guard, without the pick step's help: a sweep that picked the
+  // guild while it was due, and lost the race to one that committed first, must
+  // update nothing. The wrapper plays the winning sweep between this one's pick
+  // and its write.
+  await backdate(g1, 7);
+  const losingPool = {
+    async query(text, params) {
+      const out = await pool.query(text, params);
+      if (/LEFT JOIN platform_identity_guild_totals t ON t\.guild_id = g\.id/.test(text)) {
+        await q(`UPDATE platform_identity_guild_totals SET credits = 20, computed_at = now() WHERE guild_id = $1`, [g1]);
+      }
+      return out;
+    },
+  };
+  await gt.refreshStaleGuildTotals({ limit: 500 }, { pool: losingPool });
+  same((await stored(g1)).credits, 20,
+    'the age check lives in the write: the losing sweep leaves the winner\'s record alone');
+
+  // --- 5. unlisted, and dissolve --------------------------------------------
+  const g3 = await guild('r26-quiet', 'unlisted');
+  await member(g3, OWN, { kind: 'owner', shown: false });
+  await refresh();
+  ok(!!(await stored(g3)), 'an unlisted guild has a record too (ready for a flip to public)…');
+  same(await guilds.getPublicGuild('r26-quiet', { pool }), null, '…but no public read reaches it');
+  await q(`DELETE FROM platform_identity_guilds WHERE id = $1`, [g3]);
+  same(await stored(g3), null, 'dissolving a guild takes its record with it (FK cascade)');
+
+  // --- 6. the honest limit, DOCUMENTED, not fixed (ADR 0337 D4.4) -----------
+  // A guild owner who pads with two accounts whose numbers they already know
+  // makes a real non-public member the third, and the total then carries that
+  // member. Accepted by the owner on 2026-09-25: the notice on the join card and
+  // the per-guild switch are the defence, not this computation. If this block
+  // ever goes red because the padding stopped working, the rule changed — update
+  // ADR 0337 D4.4 before this test.
+  await activity(TARGET, CLIENT_A, 777);
+  const own = 1 + 2 + 1000; // OWN's three rows, after section 4's report
+  const pad = await guild('r26-pad');
+  await member(pad, OWN, { kind: 'owner' });
+  await member(pad, FAKE1);
+  await member(pad, FAKE2);
+  same((await sums(pad)).credits, own, 'the two fakes alone are below k');
+  await member(pad, TARGET);
+  same((await sums(pad)).credits, own + 777,
+    'PADDING WORKS (accepted): the target becomes the third non-public member and enters the sum');
+  await q(`UPDATE platform_identity_guild_members SET counted_in_totals = false WHERE guild_id = $1 AND github_id = $2`, [pad, TARGET]);
+  same((await sums(pad)).credits, own, 'the target\'s answer is the switch: off, and they are out');
+
+  // --- 7. karma below zero stays inside the column's floor ------------------
+  const neg = await guild('r26-neg');
+  await member(neg, PUB, { kind: 'owner' });
+  await q(`UPDATE platform_identity_builder_project_activity SET karma = -40 WHERE github_id = $1`, [PUB]);
+  await refresh();
+  same((await stored(neg)).karma, 0, 'a negative sum publishes as 0, never below the CHECK');
+
+  console.log(`\nguild_totals_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}