@bongos/core 1.20.81 → 1.20.82

package/modules/lifecycle/done-when.js

@@ -27,6 +27,7 @@ const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 const { executorFor } = require('./db-executor.js');
+const { cancelPendingMembershipRequests } = require('./goal-close-sweep.js');
 // BV1.R16 (task 1003603) — auto-close. Dependency-free module, so requiring it
 // here creates no cycle (db-versions.js requires THIS file, which is why the
 // rule could not live beside closeVersion).
@@ -565,6 +566,9 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null, criterionId = n
      RETURNING g.id, g.title, g.version_id, g.status`,
     [goalIds]
   );
+  // Task 1003660: an achieved goal takes no new members — close its pending asks
+  // on the same executor, so the cancel rides the ship transaction.
+  await cancelPendingMembershipRequests(exec, goals.map((g) => g.id));
   // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
   // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
   // above that have not committed yet — a check on the pool would never close the

package/modules/lifecycle/goal-close-sweep.js

@@ -0,0 +1,34 @@
+'use strict';
+// goal-close-sweep.js — closing a goal cancels its outstanding invites + join
+// requests (task 1003660, from idea 1000787).
+//
+// Task 1002887 added the accept-time `goal_not_open` re-check, which refuses a
+// stale invite when someone tries to accept it — but until then the row kept
+// listing in the invitee's inbox as something they could act on. A goal that has
+// left `open` (achieved or archived) can take no new members, so its pending rows
+// are dead; this closes them at the moment the goal closes instead.
+//
+// BOTH kinds ('invite' and 'request') are cancelled, with the same 'cancelled'
+// terminal state addGoalMember uses (core_188: "withdrawn/rescinded"). 'rejected'
+// would stamp a decision on someone nobody made one about, and 'accepted' stays
+// reserved for a flow that actually ran. resolved_by is left NULL: no person
+// resolved it, the goal closing did.
+//
+// Takes the CALLER'S executor, never the module pool, and requires nothing — so
+// the ship-time cascade in done-when.js (which cannot require db-goals.js without
+// a cycle) and every archive path share one statement, and the cancel commits or
+// rolls back with the status flip it belongs to.
+
+async function cancelPendingMembershipRequests(exec, goalIds) {
+  const ids = (Array.isArray(goalIds) ? goalIds : [goalIds]).filter((g) => g != null).map(Number);
+  if (ids.length === 0) return 0;
+  const { rowCount } = await exec.query(
+    `UPDATE goal_membership_requests
+        SET status = 'cancelled', resolved_at = now(), updated_at = now()
+      WHERE goal_id = ANY($1::bigint[]) AND status = 'pending'`,
+    [ids]
+  );
+  return rowCount ?? 0;
+}
+
+module.exports = { cancelPendingMembershipRequests };

package/modules/provisioning/app-status.js

@@ -23,27 +23,40 @@ const RENDER_URL_RE = /^https:\/\/[a-z0-9-]{1,63}\.onrender\.com\/?$/;
 
 // The stages the owner sees, in order. `failed` is not a stage: it is the setup stopping.
 const STAGES = ['creating', 'building', 'live'];
+
+// How long a build may go unanswered before the owner stops being told it is building
+// (task 1004502). Render can give up on a deploy — project 43's timed out in 15 minutes —
+// and with the key gone (ADR 0327) the platform cannot read that verdict. So past this the
+// stage is `quiet`: not a failure (we cannot see one), but no longer a promise, with the
+// way to Render's own deploy history. The poller keeps knocking, so a late answer still
+// turns it `live`. Measured from the runner's last write (`updatedAt`, provision-render.js),
+// which is when `deploying` or `linked` began — the poller's `live` write never touches it.
+const QUIET_AFTER_MS = 20 * 60_000;
 const STAGE_OF = { requested: 'creating', creating: 'creating', deploying: 'building', linked: 'building', live: 'live' };
 
 function serviceLinks(serviceId) {
   if (!SERVICE_ID_RE.test(String(serviceId || ''))) return null;
   const base = `${DASHBOARD}/web/${serviceId}`;
-  return { service: base, env: `${base}/env` };
+  return { service: base, env: `${base}/env`, deploys: `${base}/events` };
 }
 
 function appUrl(url) { return RENDER_URL_RE.test(String(url || '')) ? String(url).replace(/\/+$/, '') : null; }
 
 // The owner's view of app_host: the stage, the address, the links, the failure sentence,
 // and the answers a retry re-sends (never the key — there is none to send).
-function appStatus(appHost, { keyWaiting = false } = {}) {
+function appStatus(appHost, { keyWaiting = false, now = Date.now() } = {}) {
   const h = appHost || null;
   if (!h || h.platform !== 'render') return null;
   if (h.state === 'disconnected') return { platform: 'render', state: 'disconnected', stage: null };
   const failed = h.state === 'failed';
+  const stage = failed ? null : (STAGE_OF[h.state] || 'creating');
+  const since = Date.parse(h.updatedAt || '');
+  const quiet = stage === 'building' && Number.isFinite(since) && now - since > QUIET_AFTER_MS;
   return {
     platform: 'render',
     state: h.state || 'requested',
-    stage: failed ? null : (STAGE_OF[h.state] || 'creating'),
+    stage: quiet ? 'quiet' : stage,
+    quiet,
     // an intent that still holds the lent key has not run yet, so the owner waits rather
     // than retries
     waiting: !!keyWaiting,
@@ -80,4 +93,4 @@ function retryAnswers(h) {
   return r;
 }
 
-module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, RENDER_URL_RE, SERVICE_ID_RE };
+module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE, SERVICE_ID_RE };

package/modules/public-landing/public/projects.html

@@ -2333,6 +2333,13 @@ summary{min-height:24px;padding:3px 0;}
       v.hint.setAttribute('role', 'status');
       v.retryForm.appendChild(v.hint);
       v.root.appendChild(v.retryForm);
+    } else if (app.stage === 'quiet') {
+      /* Past the time box (task 1004502): Render may have given up, and with the key gone we
+         cannot see its verdict — so no stage is claimed, the owner is sent to Render's own
+         deploy history, and the watch keeps asking in case the app still comes up. */
+      v.root.appendChild(appPara(['Your app hasn’t answered for over 20 minutes. Render may have stopped the deploy — its deploy history says why.']));
+      if (app.links && app.links.deploys) v.root.appendChild(appPara([appLink(app.links.deploys, 'See its deploys on Render')]));
+      v.root.appendChild(appPara(['If it starts answering, this changes to Live by itself.']));
     } else {
       var at = APP_STAGES.map(function (s) { return s[0]; }).indexOf(app.stage);
       var ol = appEl('ol', 'appStages');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.81",
+  "version": "1.20.82",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.81",
+      "version": "1.20.82",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.81",
+  "version": "1.20.82",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8631,5 +8631,27 @@
       "id": "1004501",
       "text": "Each builder now chooses which goals their own Autobongos runner works, in Settings, from the goals the project allows. A builder who chooses nothing gets no unattended work. Who may run a runner at all is now a project permis"
     }
+  ],
+  "1.20.82": [
+    {
+      "id": "1004502",
+      "text": "When an app on Render never comes up, its project card no longer says 'building' forever: after 20 minutes it says the app hasn't answered and links straight to the app's deploy history on Render."
+    },
+    {
+      "id": "1004452",
+      "text": "We tested the deploy self-repair on a real throwaway project on the server. When a project has leftover unsaved changes, the platform now fixes them itself and the update goes through. When it hits something it cannot fix, it"
+    },
+    {
+      "id": "1004436",
+      "text": "Every profile now shows an earnings chart for anyone who has earned credits, even artists and ideators who have never shipped a task (before, they got no chart at all). Beside the line, a \"where it came from\" list shows each k"
+    },
+    {
+      "id": "1003660",
+      "text": "Closing a goal now clears its pending invites and join requests, so a stale invite disappears from the invitee's inbox instead of sitting there until someone tries to accept it."
+    },
+    {
+      "id": "1004509",
+      "text": "The Autobongos runner panel on the Gate page is now much lighter to read. While anything is missing it shows a short checklist saying what to do next; once everything is ready it shrinks to one status line with an on/off switc"
+    }
   ]
 }

package/scripts/hall-preview/server.js

@@ -118,6 +118,10 @@ const FIXTURE_FALLBACKS = [
   // the profile's drachmae chart reads the credits ledger (task 1003491): one
   // ledger fixture serves your own (/me/credits, exact match) and any other id.
   [/^builders\/\d+\/credits$/, 'me__credits'],
+  // the profile's earnings figure reads earnings by day and kind (task 1004436):
+  // one engineer's fixture serves any id; the artist and the ideator who never
+  // shipped a task (2001, 2002) carry their own, beside an empty activity record.
+  [/^builders\/\d+\/earnings$/, 'builders__earnings'],
   // the profile's per-craft activity log (task 1003281). One fixture per SECTION
   // rather than per id, because the section is what changes the row shape; the
   // craft and the page window are query string, which fixture matching ignores.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -107,12 +107,14 @@ await test('ASYMMETRY (rollup): the /status rollup is untouched by this task', (
 await test('EXEC: every write goes through the caller-supplied exec (so a ship txn is atomic)', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] });
   const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
-  // Three since BV1.R16 (task 1003603): the criterion update, the goal cascade,
-  // and the version auto-close — which is the point, because the third must ride
-  // the SAME exec as the first two or a version would never close on the ship
-  // that finished it.
-  assert.equal(exec.calls.length, 3, 'criterion update + goal cascade + version auto-close');
-  assert.match(exec.calls[2].sql, /UPDATE versions v/, 'and the third is the auto-close, on exec');
+  // Four: the criterion update, the goal cascade, the pending-request sweep for the
+  // goals it just achieved (task 1003660), and the version auto-close (BV1.R16,
+  // task 1003603) — every one must ride the SAME exec or a rolled-back ship could
+  // leave a half-applied close (or a version that never closes on the ship that
+  // finished it).
+  assert.equal(exec.calls.length, 4, 'criterion update + goal cascade + request sweep + version auto-close');
+  assert.match(exec.calls[2].sql, /UPDATE goal_membership_requests/, 'the sweep rides exec');
+  assert.match(exec.calls[3].sql, /UPDATE versions v/, 'and the last is the auto-close, on exec');
   assert.deepEqual(out.criteria, [CRIT]);
   assert.deepEqual(out.goals.map((g) => g.id), [77]);
   const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');

package/tests/autonomy_builder_scope.mjs

@@ -457,7 +457,7 @@ test('autonomy.run is an operational Metic permission, granted to Metic and Arch
 
 test('the owner page draws the PROJECT fence and pauses one builder; the settings panel writes the caller’s own picks', () => {
   const gate = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(gate, /fence\.project \|\| fence/, 'the switch panel must not draw the owner’s own narrowed picks as the project list');
+  assert.match(gate, /const fence = raw\.project \|\| raw;/, 'the switch panel must not draw the owner’s own narrowed picks as the project list');
   assert.match(gate, /\/autonomy\/runners\/all/);
   assert.match(gate, /\/autonomy\/builders\/\$\{encodeURIComponent\(id\)\}\/pause/);
   const html = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.html'), 'utf8');

package/tests/autonomy_fence_priority.mjs

@@ -206,8 +206,10 @@ test('the gate page renders the priority, lists it first, and posts to the prior
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
   // The PROJECT fence's priority (task 1004501): GET /autonomy/fence now answers
   // with the caller's narrowed fence, and the switch panel draws `project`.
-  assert.match(src, /renderFenceGoals\(project\.goals, project\.priority_goal_id\)/, 'the page must pass the priority it read');
+  // The chips (task 1004509) are drawn from that project fence.
+  assert.match(src, /goalChipsHtml\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
   assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
-  assert.match(src, /Make priority/);
-  assert.match(src, /Clear priority/);
+  // The star on a chip sets it, and the star on the priority chip clears it.
+  assert.match(src, /Work this goal first/);
+  assert.match(src, /Worked first — click to clear/);
 });

package/tests/autonomy_runner_identity.mjs

@@ -208,7 +208,7 @@ test('the migration adds the four columns, additively', () => {
 
 test('the gate card draws the PC, the account, the code and the restarting label', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(src, /restarting: 'Restarting'/);
+  assert.match(src, /Restarting to pick up new code/);
   assert.match(src, /PC <strong>\$\{escapeHtml\(h\.host\)\}<\/strong>/);
   assert.match(src, /Claude account \$\{escapeHtml\(h\.account\)\}/);
   assert.match(src, /behind main/);

package/tests/criterion_goal_attach.mjs

@@ -557,9 +557,13 @@ await test('setGoalStatus writes on the transaction client (task 1003840)', asyn
   const seen = [];
   const fakeClient = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ id: 3, status: 'achieved' }] }; } };
   await realGoals.setGoalStatus({ goalId: 3, status: 'achieved' }, { client: fakeClient });
-  assert.equal(seen.length, 1, 'the UPDATE reached the injected client');
+  // Two since task 1003660: the status flip, then the sweep of the goal's pending
+  // invites/requests. BOTH must land on the injected client, or the sweep would
+  // reintroduce the very pool-vs-transaction deadlock this test guards.
+  assert.equal(seen.length, 2, 'the UPDATE and the request sweep reached the injected client');
   assert.match(seen[0].sql, /UPDATE goals/);
   assert.deepEqual(seen[0].params, [3, 'achieved']);
+  assert.match(seen[1].sql, /UPDATE goal_membership_requests/);
 });
 
 // The wrapper installed above is removed, so nothing after this file's own tests

package/tests/goal_close_cancels_requests.mjs

@@ -0,0 +1,82 @@
+// tests/goal_close_cancels_requests.mjs
+//
+// Task 1003660: closing a goal (achieved / archived) cancels its pending invites
+// and join-requests, so a stale row leaves the inbox instead of waiting to be
+// refused at accept time. DB-free: a SQL-aware fake records the statements.
+//
+// Run:  node tests/goal_close_cancels_requests.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { setGoalStatus } = require('../modules/lifecycle/db-goals.js');
+const { cancelPendingMembershipRequests } = require('../modules/lifecycle/goal-close-sweep.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const norm = (q) => String(q.sql).replace(/\s+/g, ' ');
+const sweeps = (pool) => pool.queries.filter((q) => /^UPDATE goal_membership_requests/.test(norm(q)));
+const goalRow = (status) => ({ id: 7, status });
+const flip = (status) => (s) => (/^UPDATE goals/.test(s) ? { rows: [goalRow(status)] } : null);
+
+await test('cancelPendingMembershipRequests: cancels BOTH kinds, pending only, for the given goals', async () => {
+  const pool = fakePool(() => ({ rows: [], rowCount: 2 }));
+  const n = await cancelPendingMembershipRequests(pool, [7, '8']);
+  assert.equal(n, 2);
+  const [q] = sweeps(pool);
+  assert.match(norm(q), /SET status = 'cancelled'/);
+  assert.match(norm(q), /status = 'pending'/);
+  assert.doesNotMatch(norm(q), /kind\s*=/, 'neither the invite nor the request arm is excluded');
+  assert.deepEqual(q.params, [[7, 8]]);
+});
+
+await test('cancelPendingMembershipRequests: no ids → no statement', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await cancelPendingMembershipRequests(pool, []), 0);
+  assert.equal(await cancelPendingMembershipRequests(pool, null), 0);
+  assert.equal(pool.queries.length, 0);
+});
+
+for (const status of ['achieved', 'archived']) {
+  await test(`setGoalStatus(${status}) sweeps the goal's pending requests`, async () => {
+    const pool = fakePool(flip(status));
+    await setGoalStatus({ goalId: 7, status }, { pool });
+    assert.equal(sweeps(pool).length, 1);
+    assert.deepEqual(sweeps(pool)[0].params, [[7]]);
+  });
+}
+
+await test('setGoalStatus(open) — a reopen — sweeps nothing', async () => {
+  const pool = fakePool(flip('open'));
+  await setGoalStatus({ goalId: 7, status: 'open' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('setGoalStatus on an unknown goal sweeps nothing', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await setGoalStatus({ goalId: 99, status: 'archived' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('every in-module writer that archives or achieves a goal also sweeps', async () => {
+  const { readFileSync } = await import('node:fs');
+  const read = (f) => readFileSync(new URL(`../modules/lifecycle/${f}`, import.meta.url), 'utf8');
+  const count = (s, re) => (s.match(re) || []).length;
+  const closes = /status = 'archived'|status = 'achieved'/g;
+  for (const f of ['db-goals.js', 'db-versions.js', 'done-when.js']) {
+    const src = read(f);
+    // setGoalStatus takes the status as a parameter (covered above); every
+    // literal close in these files must have a sweep call.
+    assert.ok(count(src, /cancelPendingMembershipRequests\(/g) >= count(src, closes),
+      `${f}: each literal goal close needs a cancelPendingMembershipRequests call`);
+  }
+});
+
+summary();

package/tests/goal_closure_invariants.mjs

@@ -256,10 +256,13 @@ test('every statement goes through the caller exec — none reaches the module p
   // nothing reaches the module pool — is exactly what makes auto-close correct on
   // a ship: the goal it keys on was flipped in this uncommitted transaction, and
   // a pool read would not see it.
-  assert.equal(exec.calls.length, 3, 'the criterion close, the cascade and the version auto-close, all on exec');
+  // Task 1003660 added a fourth: the sweep of the achieved goal's pending
+  // invites/requests, between the cascade and the version auto-close.
+  assert.equal(exec.calls.length, 4, 'the criterion close, the cascade, the request sweep and the version auto-close, all on exec');
   assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
   assert.match(exec.calls[1].sql, /UPDATE goals g/);
-  assert.match(exec.calls[2].sql, /UPDATE versions v/);
+  assert.match(exec.calls[2].sql, /UPDATE goal_membership_requests/);
+  assert.match(exec.calls[3].sql, /UPDATE versions v/);
 });
 
 // ---------------------------------------------------------------------------

package/tests/hall_profile_world.mjs

@@ -21,12 +21,13 @@
 //     names; craftMix folds the tail past seven into "other" rather than
 //     minting an eighth hue; weeklyBuckets is a time axis (every week present,
 //     empty or not).
-//   * DRACHMAE COME FROM THE LEDGER (task 1003491). The earned line is the
-//     credits ledger — /me/credits on your own profile, /builders/:id/credits
-//     on another's — `delta` cumulated by `recorded_at`, so it ends at the
-//     balance. Per-task credits_awarded is 0 on a cost-plus instance and is no
-//     longer read at all (the owner's chart had flatlined since July on it).
-//     A viewer the ledger refuses gets the credits_reward estimate, labelled.
+//   * DRACHMAE COME FROM THE LEDGER (task 1003491), and for EVERYONE (task
+//     1004436). The earned line is GET /builders/:id/earnings — the ledger
+//     summed per day and kind, one read for your own profile and anyone's —
+//     cumulated by day, so it ends at the balance. Per-task credits_awarded is
+//     0 on a cost-plus instance and is never read (the owner's chart had
+//     flatlined since July on it). The earnings draw with no shipped task at
+//     all; the tests that prove it live in tests/profile_earnings.mjs.
 //   * NO NUMBER IS PICTURE-ONLY. Every time chart carries a table twin with a
 //     row per plotted day; the readout is written with textContent.
 //   * OWN-ONLY MEANS OWN-ONLY. /analytics/builder/:id is asked for only when
@@ -209,13 +210,13 @@ test('cumulativeByDay folds a day\'s ships into one point and accumulates, skipp
   ], 'newest-first ledger rows still accumulate oldest-first, by their own timestamp');
 });
 
-test('estimateOf is the credits_reward figure and nothing else — the per-task award column is not read anywhere', () => {
+test('the per-task award column is not read anywhere — nor the estimate that stood in for the ledger', () => {
   const C = bootCharts();
-  assert.equal(C.estimateOf({ credits_awarded: 58, credits_reward: 60 }), 60, 'the estimate ignores what was awarded');
-  assert.equal(C.estimateOf({ credits_awarded: 0, credits_reward: 45 }), 45, 'a cost-plus 0 award does not zero the estimate');
-  assert.equal(C.estimateOf({}), 0);
-  assert.equal(C.estimateOf(null), 0);
   assert.equal(C.creditsOf, undefined, 'the old ledger-or-estimate picker is gone');
+  // task 1004436: every signed-in viewer reads the earnings route, so the
+  // credits_reward estimate a refused ledger fell back to has nothing to cover.
+  assert.equal(C.estimateOf, undefined, 'the estimate fallback is gone too');
+  assert.ok(!chartsJs.includes('credits_reward'), 'profile-charts.js never sums an estimate');
   // The whole reason for task 1003491: on a cost-plus instance every task's
   // credits_awarded is 0, so a drachmae series summed from it flatlines the day
   // per-task payout stops. The column must not be read by the charts at all.
@@ -269,10 +270,9 @@ test('clipToWindow (the lookback) enters the window at the running height, not a
 
 // ---- the charts: what render asks for and draws ---------------------------------
 
-// `ledger` is what the credits routes answer: an array of rows (paged by the
-// route's 200 in the real shape, { rows, page: { total } }), or 'denied' for the
-// 403 a viewer without builder.roster.read gets on someone else's ledger.
-function bootRender({ rows, status = 200, analytics = null, ledger = [] }) {
+// `earnings` is what GET /builders/:id/earnings answers: its `days` rows
+// ({ day, kind, credits }), or 'failed' for a 500.
+function bootRender({ rows, status = 200, analytics = null, earnings = [] }) {
   const requests = [];
   const mount = { innerHTML: '', querySelector: () => null };
   const controls = { innerHTML: '', addEventListener() {}, querySelectorAll: () => [] };
@@ -285,10 +285,10 @@ function bootRender({ rows, status = 200, analytics = null, ledger = [] }) {
         const offset = Number(new URL(`http://x${url}`).searchParams.get('offset')) || 0;
         return { status: 200, ok: true, data: { total: rows.length, rows: rows.slice(offset, offset + 100) } };
       }
-      if (url.includes('/credits')) {
-        if (ledger === 'denied') return { status: 403, ok: false, data: null };
-        const offset = Number(new URL(`http://x${url}`).searchParams.get('offset')) || 0;
-        return { status: 200, ok: true, data: { rows: ledger.slice(offset, offset + 200), page: { limit: 200, offset, total: ledger.length } } };
+      if (url.includes('/earnings')) {
+        if (status !== 200) return { status, ok: false, data: null };
+        if (earnings === 'failed') return { status: 500, ok: false, data: null };
+        return { status: 200, ok: true, data: { days: earnings } };
       }
       if (url.includes('/analytics/')) return analytics ? { status: 200, ok: true, data: analytics } : { status: 403, ok: false, data: null };
       return { status: 404, ok: false, data: null };
@@ -324,13 +324,13 @@ function bootRender({ rows, status = 200, analytics = null, ledger = [] }) {
 }
 
 const ship = (d, extra = {}) => ({ shipped_at: `${d}T10:00:00Z`, discipline: 'engineer', credits_awarded: 10, credits_reward: 12, ...extra });
-// a credits-ledger row: what the instance actually paid, when
-const pay = (d, delta, extra = {}) => ({ delta, reason: 'session.token_reward', recorded_at: `${d}T22:00:00Z`, ...extra });
+// an earnings row: what the ledger paid on one day, for one kind of credit
+const pay = (d, credits, kind = 'session') => ({ day: d, kind, credits });
 
 test('render draws three public figures with a table twin per time chart, and no own-only one for another builder', async () => {
   const b = bootRender({
     rows: [ship('2026-08-01'), ship('2026-08-01'), ship('2026-08-20', { discipline: 'ui' })],
-    ledger: [pay('2026-08-01', 20), pay('2026-08-20', 30)],
+    earnings: [pay('2026-08-01', 20), pay('2026-08-20', 30)],
   });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 7, signedIn: true, now: NOW });
   const out = b.mount.innerHTML;
@@ -349,8 +349,8 @@ test('render asks for the pace chart on the viewer\'s own profile only', async (
   const own = bootRender({ rows: [ship('2026-08-01')], analytics });
   await own.C.render({ api: own.api, API: '/api/bongos', builderId: 95, selfId: '95', signedIn: true, now: NOW });
   assert.ok(own.requests.some((u) => u.includes('/analytics/builder/95')), 'own profile: the analytics read');
-  assert.ok(own.requests.some((u) => u.includes('/me/credits?')), 'own profile: your own ledger');
-  assert.ok(!own.requests.some((u) => u.includes('/builders/95/credits')), 'never through the roster route for yourself');
+  assert.ok(own.requests.some((u) => u.includes('/builders/95/earnings')), 'own profile: the same earnings read as anyone\'s');
+  assert.ok(!own.requests.some((u) => u.includes('/credits')), 'never the itemised ledger');
   assert.ok(own.mount.innerHTML.includes('id="chart-rate"'), 'and the pace chart draws');
   assert.ok(own.mount.innerHTML.includes('only you see this one'), 'saying plainly that it is private');
 });
@@ -365,10 +365,10 @@ test('signed out, the section says why and asks the server for nothing', async (
   assert.match(gone.mount.innerHTML, /visible to signed-in builders/, 'a 401 mid-way reads the same');
 });
 
-test('an empty record is one honest line, not three empty cards', async () => {
+test('an empty record AND no earnings is one honest line, not three empty cards', async () => {
   const b = bootRender({ rows: [] });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 95, signedIn: true, now: NOW });
-  assert.match(b.mount.innerHTML, /No works shipped yet/);
+  assert.match(b.mount.innerHTML, /Nothing earned or shipped yet/);
   assert.ok(!b.mount.innerHTML.includes('<figure'), 'no figure drew');
   assert.ok(!b.requests.some((u) => u.includes('/analytics/')), 'and nothing else was asked for');
 });
@@ -404,47 +404,41 @@ test('a 30-day window drops the older ships from the craft mix and clips the axi
   assert.equal(C.craftMix(within).length, 1, 'only the recent craft survives a 30-day window');
 });
 
-test('the drachmae line is the credits ledger: /me/credits on your own profile, cumulated by recorded_at, ending at the balance', async () => {
+test('the drachmae line is the earnings by day, cumulated, ending at the balance', async () => {
   const rows = [ship('2026-08-01'), ship('2026-08-20')]; // per-task awards would sum to 20
-  const ledger = [pay('2026-09-01', 12), pay('2026-08-20', 39), pay('2026-08-20', 19), pay('2026-07-05', 30)]; // balance 100
-  const b = bootRender({ rows, ledger });
+  // two kinds on one day are two rows; they fold into one point
+  const earnings = [pay('2026-07-05', 30), pay('2026-08-20', 39), pay('2026-08-20', 19, 'task'), pay('2026-09-01', 12)]; // balance 100
+  const b = bootRender({ rows, earnings });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 95, signedIn: true, now: NOW });
-  assert.ok(b.requests.some((u) => u.includes('/me/credits?limit=200&offset=0')), 'own profile: /me/credits, paged');
-  assert.ok(!b.requests.some((u) => u.includes('/builders/95/credits')), 'not the roster route');
+  assert.ok(b.requests.some((u) => u.endsWith('/api/bongos/builders/95/earnings')), 'one earnings read, unpaged');
   const out = b.mount.innerHTML;
   const fig = out.slice(out.indexOf('id="chart-drachmae"'), out.indexOf('id="chart-mix"'));
   assert.ok(fig.includes('>100 drachmae</text>'), 'the endpoint is the ledger balance, not the 20 of per-task awards');
   assert.ok(fig.includes('<td>2026-07-05</td><td class="ledger__num">30 drachmae</td>'), 'a paid day with no ship is still a point');
-  assert.ok(fig.includes('<td>2026-08-20</td><td class="ledger__num">88 drachmae</td>'), 'two payments on one day fold into one point');
-  assert.match(fig, /100 paid, from the credits ledger/);
+  assert.ok(fig.includes('<td>2026-08-20</td><td class="ledger__num">88 drachmae</td>'), 'two kinds on one day fold into one point');
+  assert.match(fig, /100 drachmae in all/);
   assert.doesNotMatch(fig, /estimated/);
 });
 
-test('another builder\'s ledger is read from /builders/:id/credits, paged by 200 to total', async () => {
-  const ledger = Array.from({ length: 450 }, (_, i) => pay(`2026-08-${String(1 + (i % 28)).padStart(2, '0')}`, 1));
-  const b = bootRender({ rows: [ship('2026-08-01')], ledger });
+test('another builder\'s earnings come from the same route, never the itemised ledger', async () => {
+  const b = bootRender({ rows: [ship('2026-08-01')], earnings: [pay('2026-08-01', 450)] });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 7, signedIn: true, now: NOW });
-  const pages = b.requests.filter((u) => u.includes('/builders/95/credits'));
-  assert.equal(pages.length, 3, 'three pages of 200 for 450 rows');
-  assert.ok(!b.requests.some((u) => u.includes('/me/credits')), 'never your own ledger for someone else\'s chart');
-  assert.ok(b.mount.innerHTML.includes('>450 drachmae</text>'), 'and every row counted once');
+  assert.ok(b.requests.some((u) => u.includes('/builders/95/earnings')), 'the earnings read');
+  assert.ok(!b.requests.some((u) => u.includes('/credits')), 'no ledger read, so no viewer is refused and handed an estimate');
+  assert.ok(b.mount.innerHTML.includes('>450 drachmae</text>'));
 });
 
-test('a viewer the ledger refuses gets the credits_reward estimate, cumulated and labelled estimated', async () => {
-  // the cost-plus shape: every award 0, the estimate is all there is to show
-  const rows = [ship('2026-08-01', { credits_awarded: 0, credits_reward: 45 }), ship('2026-08-20', { credits_awarded: 0, credits_reward: 55 })];
-  const b = bootRender({ rows, ledger: 'denied' });
+test('an earnings read that fails says so in its figure; the works charts still draw', async () => {
+  const b = bootRender({ rows: [ship('2026-08-01')], earnings: 'failed' });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 7, signedIn: true, now: NOW });
   const out = b.mount.innerHTML;
-  const fig = out.slice(out.indexOf('id="chart-drachmae"'), out.indexOf('id="chart-mix"'));
-  assert.ok(fig.includes('>100 drachmae</text>'), 'the estimate climbs where the 0 awards would have flatlined');
-  assert.match(fig, /estimated from shipped work, not the ledger/);
-  assert.ok(!out.includes('id="chart-rate"'), 'the pace chart stays own-only');
-  assert.ok(!out.includes('Could not load'), 'a 403 on the ledger is a fallback, not a failure');
+  assert.match(out, /Could not load the earnings/);
+  assert.ok(out.includes('id="chart-works"') && out.includes('id="chart-mix"'), 'the record is not taken down with it');
+  assert.doesNotMatch(out, />0 drachmae</, 'never a zero it did not read');
 });
 
-test('a readable ledger with nothing in it draws one honest line, not a crash', async () => {
-  const b = bootRender({ rows: [ship('2026-08-01')], ledger: [] });
+test('earnings with nothing in them, beside a shipped record, draw one honest line, not a crash', async () => {
+  const b = bootRender({ rows: [ship('2026-08-01')], earnings: [] });
   await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 95, signedIn: true, now: NOW });
   const out = b.mount.innerHTML;
   const fig = out.slice(out.indexOf('id="chart-drachmae"'), out.indexOf('id="chart-mix"'));
@@ -452,14 +446,19 @@ test('a readable ledger with nothing in it draws one honest line, not a crash',
   assert.ok(out.includes('id="chart-works"') && out.includes('id="chart-mix"'), 'the other charts are untouched');
 });
 
-test('the harness carries a credits-ledger fixture the chart can climb on, self-paged, serving both routes', () => {
-  const fx = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'me__credits.json'), 'utf8'));
-  assert.ok(Array.isArray(fx.rows) && fx.rows.length > 1, 'rows to draw');
-  assert.equal(fx.page.total, fx.rows.length, 'total pinned to the rows here, or the pager would loop on the same page');
-  assert.ok(fx.rows.every((r) => Number.isFinite(r.delta) && Number.isFinite(Date.parse(r.recorded_at))), 'every row is a delta at a time');
-  assert.ok(new Set(fx.rows.map((r) => r.recorded_at.slice(0, 10))).size > 1, 'across more than one day, so the line is not flat');
+test('the harness carries earnings fixtures the chart can climb on, each summing to its own total', () => {
   const server = fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'server.js'), 'utf8');
-  assert.ok(server.includes("[/^builders\\/\\d+\\/credits$/, 'me__credits']"), 'the roster route falls back to the same ledger');
+  assert.ok(server.includes("[/^builders\\/\\d+\\/earnings$/, 'builders__earnings']"), 'any id falls back to the generic earnings');
+  for (const name of ['builders__earnings', 'builders__2001__earnings', 'builders__2002__earnings']) {
+    const fx = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', `${name}.json`), 'utf8'));
+    assert.ok(Array.isArray(fx.days) && new Set(fx.days.map((d) => d.day)).size > 1, `${name}: across more than one day, so the line is not flat`);
+    assert.ok(fx.days.every((d) => /^\d{4}-\d{2}-\d{2}$/.test(d.day) && Number.isFinite(d.credits)), `${name}: every row is credits on a day`);
+    const sum = fx.days.reduce((s, d) => s + d.credits, 0);
+    assert.equal(sum, fx.total, `${name}: the days add up to the total`);
+    for (const [kind, n] of Object.entries(fx.totals)) {
+      assert.equal(fx.days.filter((d) => d.kind === kind).reduce((s, d) => s + d.credits, 0), n, `${name}: ${kind} adds up`);
+    }
+  }
 });
 
 test('the readout is written with textContent — the hover layer never builds markup from data', () => {