@bongos/core 1.21.113 → 1.21.115

package/modules/ideas/routes/blockers.js

@@ -31,6 +31,54 @@ const { validateOrRespond, LIMITS, parseId } = api;
 // reading, contributed from this factory (see ../governor-docket.js).
 const governorDocket = require('../governor-docket');
 
+// THE ASK (task 1004703). A blocker is a request from an agent to a person, so
+// it may carry an ASK in the one shape every such request takes: a question of
+// at most twelve words, two or three tap answers with a one-line result each, a
+// pick and why, the seat it waits on, what happens if nobody answers. The shape
+// is the government module's (modules/government/asks.js), reached through its
+// `government` port: checked BEFORE the blocker is filed (a slop ask files
+// nothing and answers 400 `ask_refused`, naming every fix in plain words), and
+// stored against the blocker's docket id `blockers:<id>`. The blocker's own
+// title and body stay as they are: the long text rides along, never as the ask.
+const log = api.logger('ideas');
+const governmentPort = () => (api.resolveOptional ? api.resolveOptional('government') : null);
+const askMatterId = (blockerId) => `blockers:${blockerId}`;
+// Each blocker with its ask, or `ask: null`. A read that fails leaves every ask
+// null: the list itself never fails for want of a card.
+async function withAsks(rows) {
+  const list = Array.isArray(rows) ? rows : [];
+  const gov = governmentPort();
+  let found = null;
+  if (gov && typeof gov.asksFor === 'function' && list.length) {
+    try { found = await gov.asksFor(list.map((b) => askMatterId(b.id))); } catch (err) {
+      log.warn({ err: err && err.message }, 'blockers: asks unreadable');
+    }
+  }
+  return list.map((b) => ({ ...b, ask: (found && found.get(askMatterId(b.id))) || null }));
+}
+
+// AGENTS WRITE ASKS (task 1004704). A blocker an AI session files BY HAND must
+// carry an ask: the owner ruled that agents ask like humans, short and
+// decidable, and a blocker without a card is the wall of text that ruling is
+// about. "An AI session" is a CLI session (the token an agent's tools carry; the
+// hall's form is a person, on a web session). "By hand" is every filing except
+// the scripts that file a TEMPLATED blocker unattended, named here by the
+// `source` each one sends: they keep filing whether or not they send a card, so
+// an unattended run, or a checkout older than this rule, is never refused. They
+// send a card too (scripts/gds/ask.js postWithAsk). An allow-list, not a
+// deny-list: agents file with `task`, `manual`, or no source at all, and a
+// source nobody thought of is held to the rule rather than let through.
+// tests/government_agent_asks.mjs reads each script's source off the script.
+// With no government module there is nothing to check a card against, so
+// nothing is required.
+const AGENT_SESSION_SOURCE = 'cli';
+const TEMPLATED_SOURCES = Object.freeze(['no-artifact-close', 'artifact-audit', 'autobongos']);
+function askRequired(req, body) {
+  const session = req.gdsSession;
+  if (!session || session.source !== AGENT_SESSION_SOURCE) return false;
+  return !TEMPLATED_SOURCES.includes(body.source);
+}
+
 module.exports = function buildBlockersRouter() {
   governorDocket.contributeIdeasToDocket();
   const router = express.Router();
@@ -51,7 +99,7 @@ module.exports = function buildBlockersRouter() {
         blockers.countOpenBlockers(),
       ]);
       res.set('Cache-Control', 'public, max-age=60');
-      res.json({ blockers: rows, page: api.pageMeta(limit, offset, total) });
+      res.json({ blockers: await withAsks(rows), page: api.pageMeta(limit, offset, total) });
     } catch (err) {
       console.error('[gds] GET /blockers', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
@@ -64,18 +112,46 @@ module.exports = function buildBlockersRouter() {
     if (id === null) return;
     const blocker = await blockers.getBlocker(id);
     if (!blocker) return res.fail('blocker_not_found', 404);
-    res.json({ blocker });
+    res.json({ blocker: (await withAsks([blocker]))[0] });
   });
 
   // rank: any-builder — FILE a blocker (contribution, not resolution).
+  // Body: { title, body_md?, source?, source_ref?, ask? } — `ask` is the card a
+  // person answers (task 1004703, see THE ASK above); a slop ask files nothing
+  // (400 `ask_refused`). An AI session filing by hand (a CLI session, any `source`
+  // but a templated script's) must send one: without it, 400 `ask_required` (task 1004704).
+  // → 201 { blocker, ask } (ask: the stored card, or null).
   router.post('/blockers', api.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       title: { required: true, type: 'string', maxLength: LIMITS.TITLE, minLength: 1 },
       body_md: { type: 'string', maxLength: LIMITS.DESCRIPTION },
       source: { type: 'string', maxLength: LIMITS.SOURCE },
       source_ref: { type: 'string', maxLength: LIMITS.SOURCE_REF },
+      ask: { type: 'object' },
     })) return;
     const body = req.body || {};
+    let verdict = null;
+    let gov = null;
+    if ((body.ask === undefined || body.ask === null) && askRequired(req, body)) {
+      const port = governmentPort();
+      if (port && typeof port.checkAsk === 'function') {
+        return res.fail('ask_required', {
+          status: 400,
+          message: port.askRequiredMessage || 'An AI session files a blocker with an ask. Check the card first with: node scripts/gds/ask.js check <file>',
+          details: { field: 'ask', helper: 'node scripts/gds/ask.js check <file>' },
+        });
+      }
+    }
+    if (body.ask !== undefined && body.ask !== null) {
+      gov = governmentPort();
+      if (!gov || typeof gov.checkAsk !== 'function') {
+        return res.fail('asks_unavailable', { status: 503, message: 'Asks cannot be checked here just now, so nothing was filed. Try again, or file it without the ask.' });
+      }
+      verdict = gov.checkAsk(body.ask);
+      if (!verdict.ok) {
+        return res.fail('ask_refused', { status: 400, message: gov.refusalLine(verdict.errors), details: { errors: verdict.errors } });
+      }
+    }
     try {
       const blocker = await blockers.createBlocker({
         title: body.title,
@@ -87,7 +163,17 @@ module.exports = function buildBlockersRouter() {
         // ON CONFLICT — same (source, source_ref) already captured.
         return res.status(200).json({ skipped: true, reason: 'duplicate_source_ref' });
       }
-      res.status(201).json({ blocker });
+      let ask = null;
+      if (verdict) {
+        try {
+          ask = await gov.saveAsk({ matterId: askMatterId(blocker.id), ask: verdict.ask, builderId: req.builder.id });
+        } catch (err) {
+          // the blocker stands; say plainly that its card did not
+          log.error({ err: err && err.message }, 'POST /blockers: ask not saved');
+          return res.status(201).json({ blocker, ask: null, ask_saved: false });
+        }
+      }
+      res.status(201).json({ blocker, ask });
     } catch (err) {
       if (err.code === 'TITLE_REQUIRED') return res.fail('title_required', 400);
       console.error('[gds] POST /blockers', err);
@@ -193,3 +279,6 @@ module.exports = function buildBlockersRouter() {
 
   return router;
 };
+
+// The scripts whose templated blockers file with or without a card (task 1004704).
+module.exports.TEMPLATED_SOURCES = TEMPLATED_SOURCES;

package/modules/lifecycle/module.json

@@ -43,7 +43,8 @@
     "lifecycle",
     "lifecycle.kickoffSeed",
     "lifecycle.removals",
-    "lifecycle.workflowDispatch"
+    "lifecycle.workflowDispatch",
+    "lifecycle.traffic"
   ],
   "consumes": []
 }

package/modules/lifecycle/moving.js

@@ -39,6 +39,22 @@ async function countMoving(deps = {}) {
   return { moving: active + confirmed, active, confirmed };
 }
 
+// → how many agents are at work: one per open claim, the rows GET /tasks/claimable
+// lists as `active_claims` (db-tasks.js listActiveClaims, same joins), counted in SQL
+// for GET /government/counts (task 1004716), which reads it with countMoving above
+// through the `lifecycle.traffic` port (routes/moving.js registers it).
+async function countAgentsAtWork(deps = {}) {
+  const pool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : api.pool;
+  const { rows } = await pool.query(
+    `SELECT count(*)::int AS n
+       FROM claims c
+       JOIN tasks t ON t.id = c.task_id
+       JOIN builders b ON b.id = c.builder_id
+      WHERE c.released_at IS NULL`,
+  );
+  return Number(rows[0] && rows[0].n) || 0;
+}
+
 // The GET /moving handler, injectable so a test drives it with no express.
 function movingHandler({ log, count = countMoving } = {}) {
   return async function movingRoute(_req, res) {
@@ -52,4 +68,4 @@ function movingHandler({ log, count = countMoving } = {}) {
   };
 }
 
-module.exports = { MOVING_STATUSES, countMoving, movingHandler };
+module.exports = { MOVING_STATUSES, countMoving, countAgentsAtWork, movingHandler };

package/modules/lifecycle/routes/moving.js

@@ -20,6 +20,12 @@ const log = api.logger('lifecycle');
 
 module.exports = function buildMovingRouter() {
   const router = express.Router();
+  // The `lifecycle.traffic` port (task 1004716): the two traffic counts, for GET
+  // /government/counts to read without importing this module. hasProvider-guarded
+  // so a test rebuilding the router never registers it twice.
+  if (!api.hasProvider('lifecycle.traffic')) {
+    api.registerProvider('lifecycle.traffic', { countMoving: moving.countMoving, countAgentsAtWork: moving.countAgentsAtWork });
+  }
 
   // rank: any-builder — GET /moving, the count behind Governing mode's "moving" tally.
   // A count of rows every signed-in builder can already list on the Tasks board, so no

package/modules/lifecycle/routes/project-settings.js

@@ -381,6 +381,29 @@ module.exports = function buildProjectSettingsRouter() {
     }
   });
 
+  // PATCH /project-settings/spend-cap — body { usd: number | null } (task 1004712,
+  // ADR 0379). The owner's ruling: NO spend limit by default; a cap is this
+  // optional setting, off until set. null turns it off (the row is deleted).
+  //
+  // rank: project.settings.manage (metic+, government_010), the same atom as the
+  // other writes on this page; who decides at the Treasury may put it to a sitting
+  // (requireActAlone). GET /government/treasury reads it back as `cap`.
+  router.patch('/project-settings/spend-cap', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('treasury'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { usd: {} })) return; // a number of dollars, or null to turn it off; parsed below
+    const raw = req.body ? req.body.usd : undefined;
+    if (raw === undefined) return res.fail('bad_spend_cap', { status: 400, message: 'usd: send a number of dollars a month, or null to turn the cap off' });
+    const parsed = raw === null ? { usd: null } : api.projectSettings.parseSpendCap(raw);
+    if (parsed.reason) return res.fail('bad_spend_cap', { status: 400, message: `usd: ${parsed.reason}` });
+    try {
+      await api.projectSettings.setSpendCap(parsed.usd, req.builder.id);
+      const resolved = await api.projectSettings.resolveSpendCap();
+      res.json({ ok: true, on: resolved.on, usd: resolved.usd, sentence: api.projectSettings.describeSpendCap(resolved) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/spend-cap: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // --- tweak auto-pickup (task 1004677, ADR 0371 D3/D5) ----------------------
   //
   // GET /project-settings/tweak-autopickup — the switch, the monthly cap, and how

package/modules/onboarding/approval-broadcast.js

@@ -25,11 +25,19 @@
 
 // PURE — the #member-approvals request line for a pending access request.
 // `request` is the access_requests row: { id, github_login, display_name, note }.
+// `refiled: true` is the line for a vouched re-application that took over the
+// pending row (ADR 0333 D4): the webhook cannot edit the first line, so a second
+// one carries the row's words now. Both lead with the same marker, so a 👍 on
+// either resolves the one request.
 function memberApprovalLine(request) {
   const who = request.display_name
     ? `${request.github_login} (${request.display_name})`
     : request.github_login;
   const note = request.note ? ` — “${String(request.note).slice(0, 200)}”` : '';
+  if (request.refiled) {
+    return `member-request #${request.id} — ${who} asked again with a vouched identity${note}\n`
+      + `These words replace the earlier line for #${request.id}. React 👍 to invite them, 👎 to dismiss.`;
+  }
   return `member-request #${request.id} — ${who} is asking to join the hall${note}\n`
     + `React 👍 to invite them, 👎 to dismiss.`;
 }

package/modules/onboarding/routes/access-requests.js

@@ -96,14 +96,16 @@ const APPLICATION_VOUCH_HEADER = 'X-Bongos-Platform-Assertion';
 // vouchPendingRow — a vouched re-application takes over an UNVOUCHED pending row
 // for its own login, name and note included, so a row someone else filed under
 // that login cannot pre-empt the real applicant's vouch (ADR 0333 D4). A row
-// already vouched is never re-stamped.
-function vouchPendingRow({ login, displayName, note, vouch }) {
-  return pool.query(
+// already vouched is never re-stamped. Returns the row it took over, else null.
+async function vouchPendingRow({ login, displayName, note, vouch }) {
+  const { rows } = await pool.query(
     `UPDATE access_requests
         SET display_name = $2, note = $3, applicant_github_id = $4, applicant_handle = $5, vouched_at = $6
-      WHERE lower(github_login) = lower($1) AND status = 'pending' AND applicant_github_id IS NULL`,
+      WHERE lower(github_login) = lower($1) AND status = 'pending' AND applicant_github_id IS NULL
+      RETURNING id, github_login, status, created_at`,
     [login, displayName, note, vouch.githubId, vouch.handle, new Date()],
   );
+  return rows[0] || null;
 }
 
 // How many applicant profiles one queue render may resolve from the hub (privacy
@@ -332,8 +334,16 @@ module.exports = function buildAccessRequestsRouter() {
       // Treat as success-ish: the Archon already has them in the queue.
       if (err.code === '23505') {
         if (vouch) {
-          try { await vouchPendingRow({ login, displayName, note, vouch }); }
-          catch (e) { log.error({ err: e.message }, '[gds] POST /access-requests: vouching the open request failed (non-fatal)'); }
+          try {
+            const taken = await vouchPendingRow({ login, displayName, note, vouch });
+            // The first #member-approvals line still shows the words the row held
+            // before; post the ones it holds now (same marker, same request).
+            if (taken) {
+              approvalBroadcast
+                .postMemberApprovalRequest({ ...taken, display_name: displayName, note, refiled: true })
+                .catch(() => {});
+            }
+          } catch (e) { log.error({ err: e.message }, '[gds] POST /access-requests: vouching the open request failed (non-fatal)'); }
         }
         return res.status(200).json({ ok: true, already_pending: true });
       }

package/modules/platform-identity/connections.js

@@ -293,7 +293,17 @@ async function removeConnection({ id, githubId }, { pool = defaultPool } = {}) {
 // and in theirs (D4 §2) — and in no public list, which is why this read has no
 // public twin. The returned `count` is the array's own length by construction
 // (the leak-by-subtraction rule); there is no hidden remainder.
-async function listConnections({ githubId, limit = FANOUT_1, offset = 0 }, { pool = defaultPool } = {}) {
+//
+// `here` is the PROJECT CUT a hall's profile tab reads (ADR 0337 D5.4, task
+// 1004279): only the connections who are also active builders on THIS instance.
+// This module runs only on the hub, so "this instance" is the hub's own project,
+// and its builders are core's `builders` rows — joined on github_id (text there,
+// bigint here). Both the edge and the builder row already exist; nothing records
+// where a connection was made. A literal term with no new parameter, so paging
+// and the FANOUT_1 cap read exactly as the full list does.
+const HERE_SQL = "EXISTS (SELECT 1 FROM builders b WHERE b.github_id = e.gid::text AND b.status = 'active')";
+
+async function listConnections({ githubId, limit = FANOUT_1, offset = 0, here = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH edge AS (
        SELECT id, addressee_github_id AS gid, resolved_at
@@ -307,7 +317,7 @@ async function listConnections({ githubId, limit = FANOUT_1, offset = 0 }, { poo
      SELECT e.id::text AS id, e.resolved_at AS connected_at, ${COUNTERPARTY_COLUMNS}
        FROM edge e
        JOIN platform_identity_accounts pa ON pa.github_id = e.gid
-      WHERE ${accountActiveSql('pa')}
+      WHERE ${accountActiveSql('pa')}${here ? ` AND ${HERE_SQL}` : ''}
       ORDER BY e.resolved_at DESC NULLS LAST, e.id DESC
       LIMIT $2 OFFSET $3`,
     [githubId, Math.min(Number(limit) || FANOUT_1, FANOUT_1), Math.max(0, Number(offset) || 0)],
@@ -569,6 +579,7 @@ module.exports = {
   declineConnection,
   removeConnection,
   listConnections,
+  HERE_SQL,
   listRequests,
   degreeBetween,
   mutualFrontier,

package/modules/platform-identity/routes/connections.js

@@ -16,6 +16,9 @@
 //                                       target, because 403 confirms the handle.
 //   GET    /connections               — my accepted connections. count is the
 //                                       array's own length (no hidden remainder).
+//                                       `?here=1` keeps only those who also build
+//                                       on this project — the hall profile tab's
+//                                       cut (ADR 0337 D5.4, task 1004279).
 //   GET    /connections/requests      — my inbox + outbox; stamps seen_at.
 //   GET    /connections/suggestions   — "builders you may know" (R21, task
 //                                       1002297; ADR 0202 D5): mutuals + shared
@@ -107,7 +110,10 @@ module.exports = function connectionRoutes() {
       const me = await actingAccount(req.builder);
       if (me.fail) return res.fail(...me.fail);
       const { limit, offset } = parsePagination(req, { defaultLimit: conn.FANOUT_1, maxLimit: conn.FANOUT_1 });
-      const connections = await conn.listConnections({ githubId: me.githubId, limit, offset }, { pool });
+      // `here=1` narrows to the connections who also build on this project (the
+      // hall's tab); a filter on the session's own list, never a subject.
+      const here = req.query.here === '1';
+      const connections = await conn.listConnections({ githubId: me.githubId, limit, offset, here }, { pool });
       // The count IS the array's length — never a raw total beside a filtered
       // list, which is a leak by subtraction (ADR 0171 D4 / ADR 0202 D4).
       res.json({ connections, count: connections.length });

package/modules/public-landing/public/account-private.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The account page for a private account with its record hidden and no published profile yet (task 1004259): the recruiter copy shrinks to name and picture and says it is the one exception to 'not found', the record line says nothing has been reported and that the profile is not published, and the empty profile fields show their placeholders. stub.fixtures points the account read at fixtures/me-cross-project-private.json.",
+  "_": "The account page for a private account with its record hidden and no published profile yet (task 1004259): the recruiter copy shrinks to name and picture and says it is the one exception to 'not found', the record line says nothing has been reported and that the profile is not published, and the empty profile fields show their placeholders. Private and hidden both carry the guild notice (task 1004260, ADR 0337 D4.4), each listing the builder's two guilds from the stub's held set. stub.fixtures points the account read at fixtures/me-cross-project-private.json.",
   "page": "/account",
   "surface": "public-landing",
   "stub": { "fixtures": { "me__cross-project": "me-cross-project-private" } },
@@ -9,6 +9,6 @@
   "ignoreConsole": ["/api/(gds|bongos)/me/cross-project", "\\b401\\b", "Unauthorized"],
   "ignoreControls": [".vh"],
   "states": {
-    "in-private": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#recWhat"], "checked": "input[name=visibility][value=private]", "value": [["#fName", ""], ["#fBio", ""]], "text": [["#recordLine", "No cross-project activity reported yet. Your profile is not published yet; it publishes after your next sign-in."]] } }
+    "in-private": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#recWhat", "#visGuilds", "#recordGuilds"], "count": [["#visGuildList li", 2], ["#recordGuildList li", 2]], "checked": "input[name=visibility][value=private]", "value": [["#fName", ""], ["#fBio", ""]], "text": [["#recordLine", "No cross-project activity reported yet. Your profile is not published yet; it publishes after your next sign-in."]] } }
   }
 }

package/modules/public-landing/public/account.html

@@ -63,6 +63,11 @@
 .aOpt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
 .aWhat{margin:0;font-size:13.5px;line-height:1.5;color:var(--ink-soft);max-width:70ch;}
 .aTag{font-size:12.5px;color:var(--ink-faint);}
+/* the guilds that count your numbers (ADR 0337 D4.4): one line per guild, its
+   name the link to the page where its switch lives, its current answer beside it */
+.aGuilds{display:grid;gap:6px;}
+.aGuildList{list-style:none;margin:0;padding:0;display:flex;flex-wrap:wrap;gap:0 22px;font-size:13.5px;line-height:1.5;}
+.aGuildList a{display:inline-block;min-height:24px;padding:3px 0;color:var(--link-ink);font-weight:500;text-decoration:underline;text-underline-offset:3px;}
 .acct .actions{margin:0;gap:14px;}
 .acct .btn{min-height:44px;padding:0 22px;font-family:var(--font-body);font-weight:500;font-size:15px;text-transform:lowercase;white-space:nowrap;box-shadow:none;}
 .acct .btn:hover,.acct .btn:active{transform:none;box-shadow:none;}
@@ -115,7 +120,7 @@
     <ul class="bandRow">
       <li class="bandCell"><a class="bandT" href="/projects?view=map">Sky</a><span class="bandC">the sky of every project</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=map&amp;sub=table">Table</a><span class="bandC">the same projects as rows</span></li>
-      <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own or build on</span></li>
+      <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
     </ul>
   </div>
@@ -125,7 +130,7 @@
     <p class="bandWho" id="bandWho"><img id="bandWhoImg" alt="" hidden><span class="whoName" id="bandWhoLogin"></span></p>
     <ul class="bandRow">
       <li class="bandCell"><a class="bandT" href="/projects?view=mine">My projects</a></li>
-      <li class="bandCell"><a class="bandT" href="/invitations">Invitations</a></li><li class="bandCell"><a class="bandT" href="/account" aria-current="page">Account</a></li>
+      <li class="bandCell"><a class="bandT" href="/invitations">Invitations</a></li><li class="bandCell"><a class="bandT" href="/connections">Connections</a></li><li class="bandCell"><a class="bandT" href="/account" aria-current="page">Account</a></li>
       <!-- the honest hover target; the delegated click upgrades it to the POST -->
       <li class="bandCell"><a class="bandT signout" href="/api/bongos/auth/logout">Sign out</a></li>
     </ul>
@@ -200,7 +205,8 @@
          spec D1/D3, task 1002966), PATCH /me/cross-project. Ported from the hall's
          old "Profile privacy" section. The recruiter copy must name EXACTLY what
          being discoverable grants (the D3 sliver) — tests/account_privacy_flags.mjs
-         checks it against the module's own key lists. -->
+         checks it against the module's own key lists. Private shows the guild
+         notice under its choice (ADR 0337 D4.4, task 1004260). -->
     <section class="aSec" id="aPrivacy" aria-labelledby="aPrivacy-h">
       <h2 id="aPrivacy-h">who can find you</h2>
       <p class="aSide">Your profile page can be public or private, and recruiters are let in separately — so a private profile can still be reachable for work, and a public one can stay out of recruiting entirely.</p>
@@ -211,6 +217,7 @@
             <label class="aOpt"><input type="radio" name="visibility" value="public"><span><b>Public</b>Anyone can open your profile page and find you by name.</span></label>
             <label class="aOpt"><input type="radio" name="visibility" value="private"><span><b>Private</b>Private hides the page from everyone — including you: it answers “not found” to every visitor, and you read your own record here instead.</span></label>
           </div>
+          <div class="aGuilds" id="visGuilds" hidden><p class="aWhat" id="visGuildsWhat"></p><ul class="aGuildList" id="visGuildList"></ul></div>
         </div>
         <div class="aBand">
           <span class="aLabel" id="recLabel">Recruiters</span>
@@ -229,7 +236,8 @@
     <!-- YOUR RECORD — hide_stats (ADR 0171 D4, task 1002279), PATCH
          /me/cross-project. Ported from the hall's old "Cross-project record"
          section. Enforcement is in the module's read functions, so it applies at
-         once. The owner always sees their own numbers here. -->
+         once. The owner always sees their own numbers here. Hide shows the guild
+         notice under its choice (ADR 0337 D4.4, task 1004260). -->
     <section class="aSec" id="aRecord" aria-labelledby="aRecord-h">
       <h2 id="aRecord-h">your record</h2>
       <p class="aSide">Your track record across every project you build on. Hiding it takes effect immediately everywhere — your profile, the recruiting directory, and a recruiter’s look-up of one builder.</p>
@@ -241,6 +249,7 @@
             <label class="aOpt"><input type="radio" name="record" value="show"><span><b>Show it</b>Your numbers appear on your profile and in the directories.</span></label>
             <label class="aOpt"><input type="radio" name="record" value="hide"><span><b>Hide it</b>Your numbers leave your profile and the directories. You always see them here.</span></label>
           </div>
+          <div class="aGuilds" id="recordGuilds" hidden><p class="aWhat" id="recordGuildsWhat"></p><ul class="aGuildList" id="recordGuildList"></ul></div>
         </div>
         <div class="actions"><button type="submit" class="btn" id="recordSave">save</button></div>
         <p class="projMsg" id="recordMsg" role="status" aria-live="polite"></p>
@@ -348,11 +357,12 @@
       var target = hash && document.getElementById(hash.slice(1));
       if (target && typeof target.scrollIntoView === 'function') target.scrollIntoView();
       loadBuilding();
+      loadGuilds();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
   // ---- paint: every control from the server's answer ----
-  function paint() { paintProfile(); paintHandle(); paintPrivacy(); paintRecord(); }
+  function paint() { paintProfile(); paintHandle(); paintPrivacy(); paintRecord(); paintGuilds(); }
 
   function paintProfile() {
     $('fName').value = acct.display_name || '';
@@ -527,6 +537,9 @@
   document.querySelectorAll('input[name="visibility"], input[name="recruiters"], input[name="record"]').forEach(function (r) {
     r.addEventListener('change', paintRecruitWhat);
   });
+  document.querySelectorAll('input[name="visibility"], input[name="record"]').forEach(function (r) {
+    r.addEventListener('change', paintGuilds);
+  });
   $('privacyForm').addEventListener('submit', function (ev) {
     ev.preventDefault();
     var msg = $('privacyMsg');
@@ -555,6 +568,53 @@
       : 'Cross-project record shown on your public profile.');
   });
 
+  // ---- the guilds that count your numbers (ADR 0337 D4.4, task 1004260).
+  // Every guild counts a member's numbers in its rounded totals unless they
+  // leave them out on that guild's own page — a private account and a hidden
+  // record included. So where this page offers private or hidden, it says so
+  // for the choice as it stands, before anything is saved, and lists the
+  // builder's guilds, each linking to the page where its switch lives. The
+  // switch itself is the guild page's; this page never draws or writes it.
+  // GET /me/guilds is read once, after the account: `guilds` stays null until
+  // it answers, and a failed read still says the sentence, with no list. ----
+  var guilds = null;
+  var guildsFailed = false;
+  function loadGuilds() {
+    return request('GET', '/me/guilds').then(function (res) {
+      if (res.ok && res.data && Array.isArray(res.data.guilds)) guilds = res.data.guilds;
+      else guildsFailed = true;
+      paintGuilds();
+    }, function () { guildsFailed = true; paintGuilds(); });
+  }
+  function paintGuilds() {
+    paintGuildNote('vis', picked('visibility') === 'private', 'your profile page is private');
+    paintGuildNote('record', picked('record') === 'hide', 'your record is hidden');
+  }
+  // In no guild, nothing to say; not read yet, nothing yet.
+  function paintGuildNote(key, applies, despite) {
+    var box = $(key + 'Guilds');
+    var known = !!(guilds && guilds.length);
+    box.hidden = !applies || !(known || guildsFailed);
+    if (box.hidden) return;
+    $(key + 'GuildsWhat').textContent = 'Every guild you belong to counts your numbers in its rounded totals unless you leave them out — even while ' + despite + '. ' +
+      'They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. ' +
+      (known ? 'Each guild’s page has the switch:' : 'Each guild’s page has the switch.');
+    var ul = $(key + 'GuildList');
+    ul.textContent = '';
+    (guilds || []).forEach(function (g) { ul.appendChild(guildItem(g)); });
+  }
+  function guildItem(g) {
+    var li = rowEl('li');
+    var a = document.createElement('a');
+    a.href = '/g/' + encodeURIComponent(g.slug);
+    a.textContent = g.name || g.slug;
+    li.appendChild(a);
+    var state = rowEl('span', 'aTag');
+    state.textContent = g.counted_in_totals ? ' · counted' : ' · left out';
+    li.appendChild(state);
+    return li;
+  }
+
   // ---- projects you build on (task 1004277; the rows and Leave came from
   // /projects?view=mine, task 1003774). Read once the account is shown, on its
   // own: a failed read says so and never paints a false "not building on

package/modules/public-landing/public/account.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the hub's bar (task 1004455: the identity chip from GET /me, the Projects band and the profile band with Account current) over the five sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links), the fifth being the projects you build on, from fixtures/my-projects.json (task 1004277; in-building lands on it through /account#aBuilding). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
+  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the hub's bar (task 1004455: the identity chip from GET /me, the Projects band and the profile band with Account current) over the five sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links), the fifth being the projects you build on, from fixtures/my-projects.json (task 1004277; in-building lands on it through /account#aBuilding). The guild notice (task 1004260, ADR 0337 D4.4) stays hidden while the page is public and shown; in-privacy picks Private and it appears under that choice with the builder's two guilds from the stub's held set (fixtures/guilds.json via GET /me/guilds). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
   "page": "/account",
   "surface": "public-landing",
   "modes": ["dark"],
@@ -9,11 +9,11 @@
   "ignoreControls": [".vh"],
   "states": {
     "out": { "auth": false, "actions": [["wait", 300]], "expect": { "visible": ["#door", "#signin", "#signinTop", "#projTrig"], "hidden": ["#acctBody", "#who", "#loading"] } },
-    "in": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#fName", "#fBio", "#fHandle", "#recWhat", "#recordLine", "#who"], "text": [["#whoLogin", "builder"], ["#recordLine", "Your record: 3 projects · 1000 credits · 19 works shipped · 10 karma."]], "hidden": ["#door", "#loading", "#signinTop", "#menuProjects", "#menuProfile"], "value": [["#fHandle", "builder"], ["#fName", "A Builder"], ["#fLinkX", "https://x.com/builder"]] } },
+    "in": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#fName", "#fBio", "#fHandle", "#recWhat", "#recordLine", "#who"], "text": [["#whoLogin", "builder"], ["#recordLine", "Your record: 3 projects · 1000 credits · 19 works shipped · 10 karma."]], "hidden": ["#door", "#loading", "#signinTop", "#menuProjects", "#menuProfile", "#visGuilds", "#recordGuilds"], "value": [["#fHandle", "builder"], ["#fName", "A Builder"], ["#fLinkX", "https://x.com/builder"]] } },
     "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
     "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
     "in-building": { "auth": true, "url": "/account#aBuilding", "actions": [["wait", 500]], "expect": { "visible": ["#aBuilding", "#buildingList"], "hidden": ["#buildingEmpty", "#buildingLoading"], "count": [["#buildingList .mineRow", 2]], "text": [["#buildingList .mineRow:first-child .mineRow__name", "Example World"], ["#buildingList .mineRow:first-child .mineRow__host", "example.com"]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"]] } },
-    "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "text": [["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
+    "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "visible": ["#visGuilds"], "hidden": ["#recordGuilds"], "count": [["#visGuildList li", 2]], "attr": [["#visGuildList li:first-child a", "href", "/g/forge-crew"]], "text": [["#visGuildList li:first-child a", "Forge Crew"], ["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }
 }

package/modules/public-landing/public/assets/world/r2-bongos-chrome-b.jpg.json

@@ -8,5 +8,5 @@
   "prompt": "Product render on a pure black background: a pair of bongo drums, one larger and one smaller joined by a short bridge, their shells liquid chrome with iridescent bronze, blue and violet reflections, crisp clean silhouette, seen straight on from slightly below so the drumheads are thin ellipses, faintly translucent drumheads, no hands, no text, no ground plane, no cast shadow or glow on the background. Pure black everywhere the drums are not.",
   "source": ".impeccable/mocks/world-assets/r2-bongos-chrome-b.jpg",
   "encoded": "verbatim copy of the plate (task 1003298)",
-  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+  "use": "the verbatim plate the .webp is encoded from, kept so a catalog art_url naming it still resolves; the page requests the .webp (task 1003649)"
 }

package/modules/public-landing/public/assets/world/r2-bongos-chrome-b.webp.json

@@ -0,0 +1,13 @@
+{
+  "kind": "object",
+  "model": "nano_banana_pro",
+  "aspect_ratio": "1:1",
+  "resolution": "2k",
+  "generated": "2026-08-27T13:24Z",
+  "round": 2,
+  "task": 1003649,
+  "prompt": "Product render on a pure black background: a pair of bongo drums, one larger and one smaller joined by a short bridge, their shells liquid chrome with iridescent bronze, blue and violet reflections, crisp clean silhouette, seen straight on from slightly below so the drumheads are thin ellipses, faintly translucent drumheads, no hands, no text, no ground plane, no cast shadow or glow on the background. Pure black everywhere the drums are not.",
+  "source": ".impeccable/mocks/world-assets/r2-bongos-chrome-b.jpg",
+  "encoded": "ffmpeg libwebp quality 88, yuv420p, full resolution, black ground kept at the source JPEG level (task 1003649)",
+  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+}

package/modules/public-landing/public/assets/world/r2-chrome-blob-one.jpg.json

@@ -8,5 +8,5 @@
   "prompt": "A single iridescent liquid-chrome blob, a glossy organic form with a crisp clean edge and a mirror-smooth surface reflecting bronze, deep blue and violet with one thin bright rim highlight, centred on a pure black background, nothing else, no text, no ground plane, no shadow or glow on the background. Pure black everywhere the blob is not.",
   "source": ".impeccable/mocks/world-assets/r2-chrome-blob-one.jpg",
   "encoded": "verbatim copy of the plate (task 1003298)",
-  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+  "use": "the verbatim plate the .webp is encoded from, kept so a catalog art_url naming it still resolves; the page requests the .webp (task 1003649)"
 }

package/modules/public-landing/public/assets/world/r2-chrome-blob-one.webp.json

@@ -0,0 +1,13 @@
+{
+  "kind": "object",
+  "model": "nano_banana_pro",
+  "aspect_ratio": "1:1",
+  "resolution": "2k",
+  "generated": "2026-08-27T13:24Z",
+  "round": 2,
+  "task": 1003649,
+  "prompt": "A single iridescent liquid-chrome blob, a glossy organic form with a crisp clean edge and a mirror-smooth surface reflecting bronze, deep blue and violet with one thin bright rim highlight, centred on a pure black background, nothing else, no text, no ground plane, no shadow or glow on the background. Pure black everywhere the blob is not.",
+  "source": ".impeccable/mocks/world-assets/r2-chrome-blob-one.jpg",
+  "encoded": "ffmpeg libwebp quality 88, yuv420p, full resolution, black ground kept at the source JPEG level (task 1003649)",
+  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+}

package/modules/public-landing/public/assets/world/r2-chrome-blobs-set.jpg.json

@@ -8,5 +8,5 @@
   "prompt": "Full-frame render on a pure black background: three iridescent liquid-chrome blobs, glossy organic forms with crisp clean edges and mirror-smooth surfaces reflecting bronze, deep blue and violet, thin bright rim highlights, strong depth: one very large blob upper centre-right, a medium blob lower left, a small blob far right, generous empty black space between them, nothing else, no text, no ground plane, no shadows or glow on the background. Pure black everywhere the blobs are not, so the image can be composited with a lighten blend.",
   "source": ".impeccable/mocks/world-assets/r2-chrome-blobs-set.jpg",
   "encoded": "verbatim copy of the plate (task 1003298)",
-  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+  "use": "the verbatim plate the .webp is encoded from, kept so a catalog art_url naming it still resolves; the page requests the .webp (task 1003649)"
 }

package/modules/public-landing/public/assets/world/r2-chrome-blobs-set.webp.json

@@ -0,0 +1,13 @@
+{
+  "kind": "plate",
+  "model": "nano_banana_pro",
+  "aspect_ratio": "16:9",
+  "resolution": "2k",
+  "generated": "2026-08-27T13:24Z",
+  "round": 2,
+  "task": 1003649,
+  "prompt": "Full-frame render on a pure black background: three iridescent liquid-chrome blobs, glossy organic forms with crisp clean edges and mirror-smooth surfaces reflecting bronze, deep blue and violet, thin bright rim highlights, strong depth: one very large blob upper centre-right, a medium blob lower left, a small blob far right, generous empty black space between them, nothing else, no text, no ground plane, no shadows or glow on the background. Pure black everywhere the blobs are not, so the image can be composited with a lighten blend.",
+  "source": ".impeccable/mocks/world-assets/r2-chrome-blobs-set.jpg",
+  "encoded": "ffmpeg libwebp quality 88, yuv420p, full resolution, black ground kept at the source JPEG level (task 1003649)",
+  "use": "dark mode: black plate composited with mix-blend-mode lighten"
+}