@bongos/core 1.23.10 → 1.23.12

package/modules/public-landing/public/projects.html

@@ -861,6 +861,7 @@ summary{min-height:24px;padding:3px 0;}
       <li class="bandCell"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
       <li class="bandCell"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li>
       <li class="bandCell"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li>
+      <li class="bandCell knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>
     </ul>
   </div>
 </div><!--apex-only:end-->
@@ -873,7 +874,7 @@ summary{min-height:24px;padding:3px 0;}
       <li class="bandCell"><a class="bandT" href="?view=map&amp;sub=table" data-nav="map" data-sub="table">Table</a><span class="bandC">the same projects as rows</span></li>
       <li class="bandCell"><a class="bandT" href="?view=mine" data-nav="mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="?view=new" data-nav="new">New project</a><span class="bandC">five questions and a home</span></li>
-      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><!--apex-only:end-->
+      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
     </ul>
     <!-- About and Docs are site pages, not project views: they live in the
          footer row with Privacy / Terms / Contact (owner, 2026-08-28; task 1003332). -->
@@ -11808,6 +11809,8 @@ summary{min-height:24px;padding:3px 0;}
     /* every Your-projects item a band carries (§6 asked for querySelectorAll so
        a second data-nav="mine" item could never become a signed-out leak) */
     document.querySelectorAll('[data-nav="mine"]').forEach(function (a) { (a.closest('.bandCell') || a).hidden = !signedIn; });
+    /* Builders you may know reads your own connections (task 1004256) */
+    document.querySelectorAll('.knowCell').forEach(function (c) { c.hidden = !signedIn; });
     $('onlyMine').closest('.switch').hidden = !signedIn;
     if (!signedIn) closeMenus();
     if (!signedIn && $('onlyMine').checked) { $('onlyMine').checked = false; applyMapFilter(); }

package/modules/public-landing/public/terms.html

@@ -72,6 +72,7 @@
       <li class="bandCell"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
       <li class="bandCell"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li>
       <li class="bandCell"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li>
+      <li class="bandCell knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>
     </ul>
   </div>
 </div><!--apex-only:end-->
@@ -82,7 +83,7 @@
       <li class="bandCell"><a class="bandT" href="/projects?view=map&amp;sub=table">Table</a><span class="bandC">the same projects as rows</span></li>
       <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
-      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><!--apex-only:end-->
+      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
     </ul>
   </div>
 </div>

package/modules/ui-design/kit/fixtures/connections-nosuggest.json

@@ -0,0 +1,12 @@
+{
+  "_": "The connections graph with nothing to suggest (task 1004256): one connection, nothing pending, no builder you may know. Opened by the Community menu's item (/connections#connSuggest), the panel says so rather than vanishing.",
+  "connections": [
+    { "id": "41", "connected_at": "2026-09-30T10:00:00Z", "handle": "mira", "display_name": "Mira Okafor", "avatar_url": "/__kit/avatar.svg" }
+  ],
+  "incoming": [],
+  "outgoing": [],
+  "suggestions": [],
+  "directory": [
+    { "handle": "nadia", "display_name": "Nadia Haddad", "avatar_url": "/__kit/avatar.svg" }
+  ]
+}

package/modules/ui-design/kit/fixtures/my-projects-owner-two.json

@@ -0,0 +1 @@
+{"_":"GET /my-projects for a builder who owns TWO projects (task 1002292): the community pages' Recruit door asks which project it recruits to.","owned":[{"client_id":"mercury","name":"Mercury","origin":"https://mercury.example.test","hall_origin":null,"membership_kind":"owner","joined_at":"2026-08-01T10:00:00.000Z","last_active":"2026-10-20T18:00:00.000Z"},{"client_id":"tidepool","name":"Tidepool","origin":"https://tidepool.example.test","hall_origin":null,"membership_kind":"owner","joined_at":"2026-09-02T10:00:00.000Z","last_active":"2026-10-24T18:00:00.000Z"}],"building":[],"applied":[]}

package/modules/ui-design/kit/fixtures/my-projects-owner.json

@@ -0,0 +1 @@
+{"_":"GET /my-projects for a builder who owns ONE project (task 1002292): the community pages' Recruit door shows on every row and opens Mercury's hall invite box.","owned":[{"client_id":"mercury","name":"Mercury","origin":"https://mercury.example.test","hall_origin":null,"membership_kind":"owner","joined_at":"2026-08-01T10:00:00.000Z","last_active":"2026-10-20T18:00:00.000Z"}],"building":[{"client_id":"otb","name":"Example World","origin":"https://example.com","hall_origin":"https://builders.example.com","membership_kind":"member","joined_at":"2026-07-20T10:00:00.000Z","last_active":"2026-08-27T18:00:00.000Z"}],"applied":[]}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.10",
+  "version": "1.23.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.10",
+      "version": "1.23.12",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.10",
+  "version": "1.23.12",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10447,5 +10447,17 @@
       "id": "1003363",
       "text": "cloudbongos.com now has a Community menu: a leaderboard of builders across every project (by week, month, year or all time, and by craft), a search for builders by name, and, for project owners, a list of builders who keep the"
     }
+  ],
+  "1.23.11": [
+    {
+      "id": "1004256",
+      "text": "Signed-in builders now find 'Builders you may know' in the Community menu; it opens their suggestions on the Connections page, which says so plainly when there's no one to suggest yet."
+    }
+  ],
+  "1.23.12": [
+    {
+      "id": "1002292",
+      "text": "Project owners can now press Recruit next to any builder on the community leaderboard or search, which opens their project's invite page with that builder's name already filled in."
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.10'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hub_account_page.mjs

@@ -137,6 +137,7 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
     // the Community menu's three sub-pages, folded into the band under 480px (task 1003363)
     ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+    ['Builders you may know', '/connections#connSuggest'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [
     ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Connections', '/connections'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
@@ -213,6 +214,8 @@ function boot(answer) {
   // The bar: the two triggers, and each band with its links in markup order. An
   // item's cell is its <li>; only #mineCell carries an id, so only it can hide.
   const trigs = [...els.values()].filter((e) => /\btrig\b/.test(e.attrs.class || ''));
+  // the signed-in-only "Builders you may know" cells (task 1004256), by class: a band and its phone fold
+  const knowCells = [...PAGE.matchAll(/<li class="bandCell(?: bandFold)? knowCell" hidden>/g)].map(() => ({ hidden: true }));
   const bands = [...PAGE.matchAll(/<div class="menuBand" id="(\w+)"[\s\S]*?\n<\/div>/g)].map((m) => {
     const band = els.get(m[1]);
     band.items = [...m[0].matchAll(/<li class="bandCell"(?: id="(\w+)")?><a class="([^"]+)" href="([^"]+)"([^>]*)>([^<]+)<\/a>/g)].map((a) => ({
@@ -243,7 +246,7 @@ function boot(answer) {
   });
   const calls = [];
   const dom = {
-    els, radios, calls, focused: null, assigned: null,
+    els, radios, calls, knowCells, focused: null, assigned: null,
     active: () => document.activeElement,
     // a click bubbles: the target's own listeners, its band's, then the document's
     click(target, detail = 1) {
@@ -274,6 +277,7 @@ function boot(answer) {
     },
     querySelectorAll(sel) {
       if (sel === '#profileForm [data-link]') return links;
+      if (sel === '.knowCell') return knowCells;
       if (sel === '.trig') return trigs;
       if (sel === '.menuBand') return bands;
       const names = [...sel.matchAll(/input\[name="(\w+)"\]/g)].map((m) => m[1]);
@@ -311,6 +315,7 @@ test('signed out: a 401 opens the door and shows nothing else', async () => {
   assert.equal(dom.els.get('who').hidden, true, 'no chip without a session');
   assert.equal(dom.els.get('signinTop').hidden, false, 'the sign-in door takes its slot');
   assert.equal(dom.els.get('mineCell').hidden, true, 'and the Projects band offers no Your projects');
+  assert.deepEqual(dom.knowCells.map((c) => c.hidden), [true, true], 'nor Builders you may know, in the Community band or its fold');
 });
 
 test('signed in: every control is painted from the server’s answer', async () => {
@@ -680,6 +685,7 @@ test('the chip is the hub’s identity read: GET /me fills the trigger and the p
     assert.equal(dom.els.get(id).hidden, false);
   }
   assert.equal(dom.els.get('mineCell').hidden, false);
+  assert.deepEqual(dom.knowCells.map((c) => c.hidden), [false, false]);
 });
 
 test('an account with no avatar gets a chip with no picture rather than a broken one', async () => {

package/tests/hub_community_page.mjs

@@ -78,6 +78,7 @@ test('no top block: one visually hidden h1, then one section per sub-page, only
   assert.match(MAIN, /<ol class="commRows" id="boardList" data-unit="\{\{currency\}\}" aria-labelledby="boardH"><\/ol>/, 'the unit is the instance’s own word, stamped by the server');
   assert.match(MAIN, /<p class="projMsg err" id="boardFailed" role="alert" hidden><\/p>/);
   assert.match(MAIN, /<form class="mineJoinRow commFind" id="findForm" role="search"/);
+  for (const id of ['boardFor', 'findFor']) assert.match(MAIN, new RegExp(`<div class="commFor" id="${id}" hidden></div>`), `${id}: the Recruit door’s line waits for GET /my-projects (task 1002292)`);
   assert.match(MAIN, /<h2 id="recruitH">Open to recruiters<\/h2>/, 'the hide flag is "hidden", never "private" (ADR 0337)');
   assert.match(MAIN, /<a class="btn" id="recruitSignin" href="\/api\/bongos\/auth\/web\/start\?return=\/community\/recruiters&amp;repos=1">/);
   for (const id of ['recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
@@ -100,11 +101,12 @@ test('the window dropdown and the query limits are the routes’ own (boundary-f
   assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
 });
 
-test('the script builds no markup from strings, reads only the three routes, and never re-ranks or reads the ranked tier', () => {
+test('the script builds no markup from strings, reads only the four routes, and never re-ranks or reads the ranked tier', () => {
   assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
-  // every path literal in the code: the API base, the three reads, the three sub-pages and the sign-in door
+  // every path literal in the code: the API base, the four reads, the three sub-pages, the
+  // sign-in door and the hall's invite box the Recruit door opens (task 1002292)
   const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
-  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/scouting']);
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/my-projects', '/scouting']);
   assert.doesNotMatch(CODE, /method:/, 'it only reads');
   assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
   assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
@@ -173,7 +175,9 @@ async function boot({ pathname = '/community', me = null, reads = READS() } = {}
     requests.push({ url, credentials: init.credentials });
     const a = reads[url.replace(/^\/api\/bongos/, '')];
     if (!a || a.reject) return Promise.reject(new Error('offline'));
-    return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => Promise.resolve(a.body) });
+    const res = { ok: a.status >= 200 && a.status < 300, status: a.status, json: () => Promise.resolve(a.body) };
+    // `slow`: answers on a timer, after every microtask-settled read (the order a slow network gives)
+    return a.slow ? new Promise((resolve) => setTimeout(() => resolve(res), 5)) : Promise.resolve(res);
   };
   const document = {
     title: 'Cloud Bongos — Community',
@@ -225,7 +229,8 @@ test('the leaderboard, signed out: the all-time board in the server’s order wi
   assert.equal(find(bo, 'mineRow__hint').textContent, '1 work shipped · 0 karma');
   assert.equal(ui.$('boardNote').textContent, 'Credits earned across every project, since each builder started.');
   const signedIn = await boot({ me: { github_login: 'someone' } });
-  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed in, the same one read: viewing is ungated');
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects'], 'signed in, the same board read: viewing is ungated, and the one more read is the Recruit door’s');
+  assert.equal(signedIn.$('boardList').textContent, ui.$('boardList').textContent, 'the same rows for every viewer');
 });
 
 test('the window dropdown and a craft are each one read; the pressed craft follows the pick', async () => {
@@ -320,6 +325,114 @@ test('recruiters: a door signed out, a refusal on a 403, rows only from a 200 as
   assert.equal(failed.$('recruitFailed').textContent, 'This list could not be read. Reload the page to try again.');
 });
 
+// ── 2b. the Recruit door (task 1002292; spec D6, owner 2026-10-27) ───────────
+// A project OWNER gets a Recruit link on each row: the hub cannot read a project's
+// `project.recruit` (ADR 0335 D1), so GET /my-projects' `owned` stands in. The link is the
+// project's own hall invite box with the GitHub login filled in (ADR 0353), and the
+// project decides.
+
+const OWNED = (...ps) => ({ status: 200, body: {
+  owned: ps.map(([client_id, origin, name]) => ({ client_id, name, origin, hall_origin: null, membership_kind: 'owner' })),
+  building: [{ client_id: 'zed', name: 'Zed', origin: 'https://zed.example', hall_origin: null, membership_kind: 'member' }],
+  applied: [],
+} });
+const recruitOf = (row) => find(row, 'commRecruit');
+
+test('recruit: an owner gets a Recruit link on every row but their own, opening their project’s hall invite box with the GitHub login filled in', async () => {
+  const reads = READS();
+  reads['/my-projects'] = OWNED(['mercury', 'https://mercury.example/x?y=1', 'Mercury']);
+  const ui = await boot({ me: { github_login: 'BO' }, reads });
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects']);
+  const [ana, bo] = kids(ui.$('boardList'));
+  const a = recruitOf(ana);
+  assert.equal(a.tag, 'a');
+  assert.equal(a.textContent, 'Recruit');
+  assert.equal(a.attrs.href, 'https://mercury.example/builders/watch?invite=ana', 'the project’s origin and nothing else of the address');
+  assert.equal(a.attrs.target, '_blank', 'the board stays open behind it');
+  assert.equal(a.attrs.rel, 'noopener');
+  assert.equal(a.attrs['aria-label'], 'Recruit ANA to Mercury (opens in a new tab)', 'the new tab is said, not sprung');
+  assert.equal(recruitOf(bo).tag, 'span', 'your own row: an invisible twin keeps the credits in line');
+  assert.equal(recruitOf(bo).attrs['aria-hidden'], 'true');
+  assert.match(ui.$('boardList').className, /\bcanRecruit\b/);
+  assert.equal(ui.$('boardFor').hidden, false);
+  assert.equal(ui.$('boardFor').textContent, 'Recruit opens Mercury’s hall with their name filled in, and you send the invite there.');
+  await ui.pick('30d');
+  assert.equal(recruitOf(kids(ui.$('boardList'))[0]).attrs.href, 'https://mercury.example/builders/watch?invite=cy', 'a new window’s rows carry it too');
+  reads['/community/leaderboard?window=all'].slow = true;
+  const late = await boot({ me: { github_login: 'BO' }, reads });
+  assert.equal(kids(late.$('boardList')).length, 0, 'the board has not answered yet');
+  assert.equal(late.$('boardFor').hidden, false, 'the owner’s line is up before the board');
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  await settle();
+  assert.equal(recruitOf(kids(late.$('boardList'))[0]).attrs.href, 'https://mercury.example/builders/watch?invite=ana', 'a board that answers after GET /my-projects draws its doors as it paints');
+  delete reads['/community/leaderboard?window=all'].slow;
+  reads['/community/leaderboard?window=all'].body.results[0].github_login = 'a b&c';
+  const odd = await boot({ me: { github_login: 'x' }, reads });
+  assert.equal(recruitOf(kids(odd.$('boardList'))[0]).attrs.href, 'https://mercury.example/builders/watch?invite=a%20b%26c', 'the login is encoded into the query');
+});
+
+test('recruit: none for a builder who owns no project, signed out, on a failed read, or for a project with no web address; the rows stay the same', async () => {
+  const reads = READS();
+  reads['/my-projects'] = OWNED();
+  const member = await boot({ me: { github_login: 'someone' }, reads });
+  assert.equal(member.gets().pop(), '/api/bongos/my-projects');
+  assert.ok(kids(member.$('boardList')).every((r) => !recruitOf(r)), 'building on a project is not owning one');
+  assert.equal(member.$('boardFor').hidden, true);
+  assert.doesNotMatch(member.$('boardList').className, /canRecruit/);
+  const out = await boot({ reads });
+  assert.deepEqual(out.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed out, nobody is asked about projects');
+  for (const answer of [{ status: 500, body: {} }, { status: 401, body: {} }, { reject: true }, OWNED(['evil', 'javascript:alert(1)', 'Evil'], ['none', null, 'None'])]) {
+    reads['/my-projects'] = answer;
+    const ui = await boot({ me: { github_login: 'someone' }, reads });
+    assert.ok(kids(ui.$('boardList')).every((r) => !recruitOf(r)), 'no door, and the board is drawn all the same');
+    assert.equal(kids(ui.$('boardList')).length, 2);
+    assert.equal(ui.$('boardFailed').hidden, true, 'a failed projects read is never the board’s failure');
+    assert.equal(ui.$('boardFor').hidden, true);
+  }
+});
+
+test('recruit: several projects are one “Recruit to” choice, and picking one re-points every row', async () => {
+  const reads = READS();
+  reads['/my-projects'] = OWNED(['mercury', 'https://mercury.example', 'Mercury'], ['venus', 'http://venus.example:8080', 'Venus']);
+  const ui = await boot({ me: { github_login: 'nobody' }, reads });
+  const pick = find(ui.$('boardFor'), 'commForPick');
+  assert.equal(pick.tag, 'select');
+  assert.equal(pick.id, 'boardForPick');
+  assert.deepEqual(kids(pick).map((o) => [o.value, o.textContent]), [['0', 'Mercury'], ['1', 'Venus']]);
+  assert.equal(kids(ui.$('boardFor'))[0].attrs.for, 'boardForPick', 'the choice is labelled');
+  assert.match(ui.$('boardFor').textContent, /^Recruit to/);
+  assert.equal(recruitOf(kids(ui.$('boardList'))[0]).attrs.href, 'https://mercury.example/builders/watch?invite=ana', 'the first project, as the server listed them');
+  pick.value = '1';
+  for (const f of pick._on.change || []) f({});
+  await settle();
+  const [ana, bo] = kids(ui.$('boardList'));
+  assert.equal(recruitOf(ana).attrs.href, 'http://venus.example:8080/builders/watch?invite=ana');
+  assert.equal(recruitOf(bo).attrs['aria-label'], 'Recruit bo to Venus (opens in a new tab)');
+  assert.equal(find(ui.$('boardFor'), 'commForPick'), pick, 'the choice is not redrawn, so it keeps the focus');
+  pick.value = '7';
+  for (const f of pick._on.change || []) f({});
+  assert.equal(recruitOf(kids(ui.$('boardList'))[0]).attrs.href, 'http://venus.example:8080/builders/watch?invite=ana', 'a value it never offered changes nothing');
+});
+
+test('recruit: found builders carry it too; the recruiter list never asks', async () => {
+  const reads = READS();
+  reads['/my-projects'] = OWNED(['mercury', 'https://mercury.example', 'Mercury']);
+  const ui = await boot({ pathname: '/community/find', me: { github_login: 'ph' }, reads });
+  assert.deepEqual(ui.gets(), ['/api/bongos/my-projects'], 'nothing searched until asked');
+  assert.equal(ui.$('findFor').hidden, false);
+  assert.equal(ui.$('findFor').textContent, 'Recruit opens Mercury’s hall with their name filled in, and you send the invite there.');
+  assert.equal(ui.$('boardFor').hidden, true, 'only the shown sub-page’s line');
+  ui.$('findQ').value = 'pri';
+  await ui.submit();
+  const [priya, hidden] = kids(ui.$('findList'));
+  const acts = find(priya, 'mineRow__actions');
+  assert.equal(recruitOf(acts).attrs.href, 'https://mercury.example/builders/watch?invite=priyan', 'by GitHub login, never the handle');
+  assert.equal(recruitOf(hidden), null, 'your own row: no door, and no twin in a row that keeps no columns');
+  assert.equal(ui.$('findStatus').textContent, '2 builders found.');
+  const recruiters = await boot({ pathname: '/community/recruiters', me: { github_login: 'owner' }, reads });
+  assert.deepEqual(recruiters.gets(), ['/api/bongos/scouting'], 'the recruiter list draws no Recruit door');
+});
+
 // ── 3. every bar carries the Community menu ──────────────────────────────────
 
 const SERVES_A_CHILD = ['privacy.html', 'terms.html', 'contact.html', 'index.html', 'projects.html'];
@@ -330,13 +443,17 @@ const ITEMS = [
   ['/community/find', 'Find a builder', 'anyone building here, by name or role'],
   ['/community/recruiters', 'Open to recruiters', 'who is open to recruiting, for project owners'],
 ];
+// signed in only, and it opens /connections' own panel rather than a second one here (task 1004256)
+const KNOW = '<a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>';
 
 test('every page that wears the hub’s bar carries the Community menu before Projects; apex-only where the page serves a child', () => {
   const { stripApexOnly } = require('../src/platform-server.js');
   const trig = '<button class="trig commTrig" type="button" id="commTrig" data-menu="community" aria-expanded="false" aria-controls="menuCommunity"';
   const band = ['<div class="menuBand" id="menuCommunity" data-menu="community" hidden>', '  <div class="bandIn">', '    <ul class="bandRow">',
-    ...ITEMS.map(([h, t, c]) => `      <li class="bandCell"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`), '    </ul>', '  </div>', '</div>'].join('\n');
-  const fold = ITEMS.map(([h, t, c]) => `<li class="bandCell bandFold"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`).join('');
+    ...ITEMS.map(([h, t, c]) => `      <li class="bandCell"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`),
+    `      <li class="bandCell knowCell" hidden>${KNOW}`, '    </ul>', '  </div>', '</div>'].join('\n');
+  const fold = ITEMS.map(([h, t, c]) => `<li class="bandCell bandFold"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`).join('')
+    + `<li class="bandCell bandFold knowCell" hidden>${KNOW}`;
   for (const f of [...SERVES_A_CHILD, ...HUB_ONLY]) {
     const html = read(f);
     const apex = SERVES_A_CHILD.includes(f);
@@ -346,10 +463,20 @@ test('every page that wears the hub’s bar carries the Community menu before Pr
     assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its three sub-pages`);
     assert.ok(html.indexOf('id="menuCommunity"') < html.indexOf('id="menuProjects"'), `${f}: the bands in the bar’s order`);
     assert.ok(html.includes(wrap(apex, fold)), `${f}: the three folded into the Projects band for phones`);
-    if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity/, `${f}: a child has no community pages, so no trace of the menu`);
+    if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity|connSuggest/, `${f}: a child has no community pages, so no trace of the menu`);
   }
 });
 
+test('Builders you may know: shown only once GET /me names someone, and drawn once, on /connections', () => {
+  // every bar script that paints the signed-in state shows or hides both cells with it
+  assert.match(read('assets/hub-bar.js'), /\$\('mineCell'\)\.hidden = !me;\n\s*Array\.prototype\.forEach\.call\(document\.querySelectorAll\('\.knowCell'\), function \(c\) \{ c\.hidden = !me; \}\);/);
+  assert.match(read('projects.html'), /function paintShellIdentity\(\) \{[\s\S]*?document\.querySelectorAll\('\.knowCell'\)\.forEach\(function \(c\) \{ c\.hidden = !signedIn; \}\);/);
+  assert.match(read('index.html'), /if \(mine\) mine\.hidden = false;\n\s*document\.querySelectorAll\('\.knowCell'\)\.forEach\(function \(c\) \{ c\.hidden = false; \}\);/);
+  // the panel it opens exists, and the community page reads no suggestions of its own
+  assert.match(read('connections.html'), /<section id="connSuggest" aria-labelledby="connSuggestH" hidden>/);
+  assert.doesNotMatch(read('community.html').split('<script>')[1], /connections\/suggestions/);
+});
+
 test('the menu folds into the Projects band under 480px on the hub and 900px on the landing; the arrows skip what CSS does not draw', () => {
   const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
   assert.match(css, /\.trig\[aria-expanded="true"\],\.trig\[aria-current="true"\]\{color:var\(--ink\);text-decoration:underline;/, 'on its own pages the menu reads as the current section');
@@ -357,6 +484,10 @@ test('the menu folds into the Projects band under 480px on the hub and 900px on
   assert.match(css.split('@media (max-width:480px){')[1].split('\n}')[0], /\.commTrig\{display:none;\}\s*\.bandFold\{display:block;\}/);
   const index = read('index.html');
   assert.match(index, /\n\.bandFold\{display:none\}\n/);
+  // a hidden fold cell (signed in only, task 1004256) must stay down where the fold shows:
+  // cosmos.css's [hidden] rule is !important; the landing has none, so it carries its own
+  assert.match(css, /\n\[hidden\]\{display:none !important;\}\n/);
+  assert.match(index, /\n\.bandFold\[hidden\]\{display:none\}\n/);
   assert.match(index.split('@media (max-width:900px){')[1], /^[\s\S]*?\.commTrig\{display:none\}\s*\.bandFold\{display:block\}/);
   for (const f of ['assets/hub-bar.js', 'projects.html', 'index.html']) {
     assert.match(read(f), /return !a\.closest\('\[hidden\]'\) && a\.offsetParent !== null; \}\);/, `${f}: the arrows skip a cell CSS does not draw`);
@@ -419,11 +550,20 @@ test('the kit renders each sub-page for everyone, the empty board, and a project
   assert.equal(states.states['out-find'].url, '/community/find');
   assert.equal(states.states['in-recruiters'].url, '/community/recruiters');
   assert.ok(states.states['in-recruiters'].expect.visible.includes('#recruitClosed'), 'signed in but not admitted: told, shown no one');
-  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter']]) {
+  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter'], ['community-owner.states.json', 'my-projects', 'my-projects-owner'], ['community-owner-two.states.json', 'my-projects', 'my-projects-owner-two']]) {
     assert.equal(json(file).stub.fixtures[name], fixture);
     assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
   }
   assert.equal(json('community-recruiter.states.json').states['in-recruiter'].url, '/community/recruiters');
+  // the Recruit door (task 1002292): an owner of one project on the board and the search, and of two with the choice
+  assert.ok(json('community-owner.states.json').states['in-owner'].expect.count.some(([sel, n]) => sel === '#boardList a.commRecruit' && n === 6));
+  assert.equal(json('community-owner.states.json').states['in-owner-find'].url, '/community/find');
+  assert.ok(json('community-owner-two.states.json').states['in-owner-two-picked'].actions.some((a) => a[0] === 'select' && a[1] === '#boardForPick'));
+  for (const f of ['my-projects-owner', 'my-projects-owner-two']) {
+    const owned = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', f + '.json'), 'utf8')).owned;
+    assert.ok(owned.length && owned.every((p) => p.membership_kind === 'owner' && /^https:\/\//.test(p.origin)), `${f}: owned projects with web addresses`);
+  }
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'my-projects.json'), 'utf8')).owned, [], 'the default builder owns nothing, so every other state draws no door');
 });
 
 function stub(env = {}) {

package/tests/hub_connections_page.mjs

@@ -128,6 +128,7 @@ function el(tag) {
   n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
   n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
   n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.scrollIntoView = () => { n.scrolled = (n.scrolled || 0) + 1; };
   return n;
 }
 const settle = async () => { for (let i = 0; i < 60; i++) await Promise.resolve(); };
@@ -161,7 +162,7 @@ const GRAPH = () => ({
   ], count: 2 } },
 });
 
-async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRAPH(), writes = [] } = {}) {
+async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRAPH(), writes = [], hash = '' } = {}) {
   const ids = new Map();
   for (const id of [...PAGE.matchAll(/ id="([^"]+)"/g)].map((m) => m[1])) {
     const n = el('x');
@@ -180,15 +181,18 @@ async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRA
     return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => (a.body === undefined ? Promise.reject(new SyntaxError('no body')) : Promise.resolve(a.body)) });
   };
   const document = { getElementById: (id) => ids.get(id) || null, createElement: el };
-  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) } };
-  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, Date, isNaN, encodeURIComponent };
+  const winOn = {};
+  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) }, addEventListener: (t, f) => { (winOn[t] ||= []).push(f); } };
+  const location = { hash };
+  const sandbox = { window, document, fetch, location, console, Promise, JSON, String, Object, Array, URL, Date, isNaN, encodeURIComponent };
   vm.createContext(sandbox);
   vm.runInContext(SCRIPT, sandbox, { filename: 'connections.html' });
   await settle();
   const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
   const key = async (n, k) => { const e = { key: k, preventDefault() { e.prevented = true; } }; for (const f of n._on.keydown || []) f(e); await settle(); return e; };
   const gets = () => requests.filter((r) => r.method === 'GET').map((r) => r.url);
-  return { ids, requests, gets, click, key, $: (id) => ids.get(id) };
+  const hashTo = async (h) => { location.hash = h; for (const f of winOn.hashchange || []) f({}); await settle(); };
+  return { ids, requests, gets, click, key, hashTo, $: (id) => ids.get(id) };
 }
 const button = (row, label) => all(row, 'btn').find((b) => b.textContent === label);
 
@@ -283,6 +287,51 @@ test('a failed suggestions read drops only that panel', async () => {
   assert.equal(kids(ui.$('connList')).length, 2);
 });
 
+test('opened by the Community menu’s item (#connSuggest): scrolled to once, and an empty panel says so', async () => {
+  // the panel draws after the browser's own jump to the fragment, so the page makes it, once
+  let ui = await boot({ hash: '#connSuggest', writes: [{ status: 201, body: { status: 'pending' } }] });
+  assert.equal(ui.$('connSuggest').hidden, false);
+  assert.equal(ui.$('suggestNone').hidden, true, 'suggestions need no explaining');
+  assert.equal(ui.$('connSuggest').scrolled, 1);
+  await ui.click(button(kids(ui.$('suggestList'))[0], 'Connect'));
+  assert.equal(ui.gets().length, 6);
+  assert.equal(ui.$('connSuggest').scrolled, 1, 'a re-read after Connect does not jump the page again');
+
+  const none = GRAPH();
+  none['/connections/suggestions'].body = { suggestions: [] };
+  ui = await boot({ hash: '#connSuggest', reads: none });
+  assert.equal(ui.$('connSuggest').hidden, false, 'asked for by name, the panel answers rather than vanishing');
+  assert.equal(ui.$('suggestNone').hidden, false);
+  assert.match(PAGE, /<p class="mineEmpty" id="suggestNone" hidden>No one to suggest yet\. Suggestions come from the connections and projects you have in common with other builders\.<\/p>/);
+
+  const failed = GRAPH();
+  failed['/connections/suggestions'] = { status: 500, body: {} };
+  ui = await boot({ hash: '#connSuggest', reads: failed });
+  assert.equal(ui.$('connSuggest').hidden, true, 'an unread list is not "no one to suggest"');
+  assert.equal(ui.$('connSuggest').scrolled, undefined);
+});
+
+test('the menu item pressed while already on the page: the hash change is answered as an arrival', async () => {
+  const none = GRAPH();
+  none['/connections/suggestions'].body = { suggestions: [] };
+  let ui = await boot({ reads: none });
+  assert.equal(ui.$('connSuggest').hidden, true, 'a plain visit: no suggestions, no empty shell');
+  await ui.hashTo('#connSuggest');
+  assert.equal(ui.gets().length, 6, 'one re-read');
+  assert.equal(ui.$('connSuggest').hidden, false);
+  assert.equal(ui.$('suggestNone').hidden, false);
+
+  ui = await boot();
+  await ui.hashTo('#connSuggest');
+  assert.equal(ui.$('connSuggest').scrolled, 1, 'scrolled to once the panel is drawn');
+  await ui.hashTo('#connList');
+  assert.equal(ui.gets().length, 6, 'any other hash reads nothing');
+
+  ui = await boot({ me: null });
+  await ui.hashTo('#connSuggest');
+  assert.deepEqual(ui.requests, [], 'signed out, the door stands and nothing is read');
+});
+
 test('Accept, Decline, Remove and Withdraw: one call each, then the page re-reads', async () => {
   const cases = [
     ['incomingList', 'Accept', 'POST', '/api/bongos/connections/51/accept', { status: 200, body: { status: 'accepted' } }, 'Connected.'],

package/tests/hub_guild_page.mjs

@@ -216,6 +216,7 @@ function boot({ pathname = '/g/forge-crew', me = null, answer = () => NOT_FOUND,
     querySelectorAll(sel) {
       if (sel === '.trig') return trigs;
       if (sel === '.menuBand') return bands;
+      if (sel === '.knowCell') return [];
       const m = sel.match(/^input\[name="(\w+)"\]$/);
       if (!m) throw new Error(`unstubbed selector: ${sel}`);
       return radios.filter((r) => r.name === m[1]);

package/tests/landing_legal_pages.mjs

@@ -195,6 +195,7 @@ for (const p of PAGES) {
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
       // the Community menu's three sub-pages, folded into the band under 480px (task 1003363); apex-only
       ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+      ['Builders you may know', '/connections#connSuggest'],
     ], 'this page has no views of its own, so every item names /projects in full');
     assert.deepEqual(bandLinks(bandOf(stripApexOnly(html, false), 'menuProjects')).map((l) => l[0]), ['Sky', 'Table', 'Your projects', 'New project'], 'a child has no /community');
     assert.deepEqual(bandLinks(bandOf(html, 'menuProfile')), [
@@ -264,6 +265,8 @@ function bootBar(html, answer, pathname) {
     els.set(m[3], el(m[3], /\shidden\b/.test(m[2] + m[4]), attrs));
   }
   const trigs = [...els.values()].filter((e) => /\btrig\b/.test(e.attrs.class || ''));
+  // the signed-in-only "Builders you may know" cells (task 1004256), by class; a child has none
+  const knowCells = [...html.matchAll(/<li class="bandCell(?: bandFold)? knowCell" hidden>/g)].map(() => ({ hidden: true }));
   const bands = [...html.matchAll(/<div class="menuBand" id="(\w+)"[\s\S]*?\n<\/div>/g)].map((m) => {
     const band = els.get(m[1]);
     band.items = [...m[0].matchAll(/<li class="bandCell"(?: id="(\w+)")?><a class="([^"]+)" href="([^"]+)"([^>]*)>([^<]+)<\/a>/g)].map((a) => ({
@@ -287,7 +290,7 @@ function bootBar(html, answer, pathname) {
   const event = (extra) => ({ prevented: false, preventDefault() { this.prevented = true; }, ...extra });
   const calls = [];
   const dom = {
-    els, calls, assigned: null,
+    els, calls, knowCells, assigned: null,
     active: () => document.activeElement,
     band: (id) => els.get(id),
     item: (id, text) => els.get(id).items.find((i) => i.text === text),
@@ -312,6 +315,7 @@ function bootBar(html, answer, pathname) {
     querySelectorAll(sel) {
       if (sel === '.trig') return trigs;
       if (sel === '.menuBand') return bands;
+      if (sel === '.knowCell') return knowCells;
       throw new Error(`unstubbed selector: ${sel}`);
     },
   };
@@ -341,6 +345,7 @@ for (const p of PAGES) {
       assert.equal(out.els.get('who').hidden, true, 'no chip without a session');
       assert.equal(out.els.get('signinTop').hidden, false);
       assert.equal(out.els.get('mineCell').hidden, true, 'and the Projects band offers no Your projects');
+      assert.deepEqual(out.knowCells.map((c) => c.hidden), hub ? [true, true] : [], 'nor Builders you may know; a child has no community menu at all');
       assert.equal(await out.window.HubBar.ready, null);
 
       const dom = bootBar(served, signedIn, p.route);
@@ -352,6 +357,7 @@ for (const p of PAGES) {
       assert.equal(dom.els.get('who').getAttribute('aria-label'), 'Account, octocat');
       for (const id of ['whoImg', 'bandWhoImg']) assert.equal(dom.els.get(id).src, 'https://avatars.example/u/1');
       assert.equal(dom.els.get('mineCell').hidden, false);
+      assert.deepEqual(dom.knowCells.map((c) => c.hidden), hub ? [false, false] : []);
       assert.deepEqual(dom.band('menuProfile').items.map((i) => i.text), hub ? ['My projects', 'Invitations', 'Connections', 'Account', 'Sign out'] : ['My projects', 'Sign out']);
     });
   }