@bongos/core 1.23.13 → 1.23.15

package/tests/hall_studio_home.mjs

@@ -129,7 +129,7 @@ function heldClock(h, m) {
   return Held;
 }
 
-function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } = {}) {
+function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY, rank = 'metic', queue = null } = {}) {
   const root = augment(makeEl('body', {}));
   root.innerHTML = body;
   const byId = (id) => walk(root, (c) => (c.id === id ? c : null));
@@ -156,7 +156,7 @@ function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } =
       const body = opts ? opts.body : undefined;
       requests.push({ method, url, body });
       const key = `${method} ${url.replace(/^\/api\/bongos/, '')}`;
-      if (key === 'GET /me') return signedIn ? ok({ builder: { id: ME, display_name: 'Artist A', rank: 'metic' } }) : { ok: false, status: 401, data: {} };
+      if (key === 'GET /me') return signedIn ? ok({ builder: { id: ME, display_name: 'Artist A', rank } }) : { ok: false, status: 401, data: {} };
       const a = answers[key];
       if (typeof a === 'function') return a(body);
       if (a) return a;
@@ -170,6 +170,7 @@ function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY } =
     localStorage: { getItem: () => null, setItem() {} },
     addEventListener() {},
     scrollTo() {},
+    ...(queue ? { OTBApprovalQueue: queue.api, OTBApprovalQueueLib: require('../modules/hall-ui/public/approval-queue-lib.js') } : {}),
   };
   // setInterval is held, never real (a real one would keep the run alive): the
   // test fires each registered tick by hand, as a minute passing.
@@ -243,8 +244,8 @@ try {
     ]);
     assert.equal(lib.landingHost('https://cloudbongos.com/', 'builders.x.test'), 'cloudbongos.com', 'the stamped origin wins');
     assert.equal(lib.landingHost('{{publicOrigin}}', 'builders.x.test'), 'x.test', 'an unstamped token is no address');
-    assert.equal(lib.askedLine(NEXT.asked_pages), '1 page has been asked for. It comes up first in the Tweak/CopyWrite Flow.');
-    assert.equal(lib.askedLine(4), '4 pages have been asked for. They come up first in the Tweak/CopyWrite Flow.');
+    assert.equal(lib.askedLine(NEXT.asked_pages), '1 page has been asked for. It comes up first in Work through tweaks.');
+    assert.equal(lib.askedLine(4), '4 pages have been asked for. They come up first in Work through tweaks.');
     assert.equal(lib.askedLine(0), '');
   });
 
@@ -260,7 +261,7 @@ try {
     assert.deepEqual(rows.map((r) => [r.title, r.state, r.age, r.stuck]), [
       ['Contact', 'Approved, going live', 'for 17 days', true],
       ['Tasks', 'Submitted, waiting to be applied', 'for 1 day', false],
-      ['Status', 'Needs a look', 'since today', true],
+      ['Status', 'Needs to be reviewed', 'since today', true],
     ]);
     assert.deepEqual(lib.inFlightRows(null, NOW), []);
   });
@@ -309,13 +310,79 @@ try {
     assert.equal(s.requests.filter((r) => /copy-desk\/(tally|next|pages)/.test(r.url)).length, 0);
   });
 
+  // A stand-in for the Approval queue panel: what the studio asks of it is the point here.
+  const stubQueue = ({ count = 2, pending = 0 } = {}) => {
+    const calls = { open: [], refresh: 0 };
+    const api = { mount: (o) => ({
+      open: async (...a) => { calls.open.push(a); },
+      refresh: async () => { calls.refresh += 1; o.onCount(count); return count; },
+      count: () => count,
+      notAppliedCount: () => pending,
+    }) };
+    return { calls, api };
+  };
+
+  await test('the approve door shows for metic and up, and never mounts the queue below that', async () => {
+    const q = stubQueue();
+    const metic = bootStudio({ answers: HOME, queue: q });
+    await metic.settle();
+    assert.equal(metic.el('studio-approvals').hidden, false);
+    assert.equal(q.calls.refresh, 1, 'the door hears how many wait');
+    const low = stubQueue();
+    const thetes = bootStudio({ answers: HOME, queue: low, rank: 'thetes' });
+    await thetes.settle();
+    assert.equal(thetes.el('studio-approvals').hidden, true, 'below metic the door stays hidden');
+    assert.equal(low.calls.refresh, 0, 'and its queue is never read');
+    const gone = bootStudio({ answers: HOME, rank: 'archon' });
+    await gone.settle();
+    assert.equal(gone.el('studio-approvals').hidden, true, 'no panel loaded: no door to nowhere');
+  });
+
+  await test('an empty approval queue says so in a toast; a submitted-not-applied round still opens the dialog', async () => {
+    const empty = stubQueue({ count: 0 });
+    const a = bootStudio({ answers: HOME, queue: empty });
+    await a.settle();
+    await a.click('studio-approvals');
+    assert.equal(empty.calls.open.length, 0, 'no blank dialog');
+    assert.match(a.el('toast').textContent, /Nothing is waiting for your sign-off/);
+    const pending = stubQueue({ count: 0, pending: 1 });
+    const b = bootStudio({ answers: HOME, queue: pending });
+    await b.settle();
+    await b.click('studio-approvals');
+    assert.equal(pending.calls.open.length, 1, 'the not-applied list is still reachable');
+    const full = stubQueue({ count: 2 });
+    const c = bootStudio({ answers: HOME, queue: full });
+    await c.settle();
+    await c.click('studio-approvals');
+    assert.equal(full.calls.open.length, 1);
+    assert.equal(full.calls.open[0][1].reload, false, 'one read, then open without re-reading');
+    assert.equal(full.calls.refresh, 2, 'the page load and the click, nothing more');
+  });
+
+  await test('a page that Needs to be reviewed opens its own approval card from the status panel', async () => {
+    const q = stubQueue();
+    const waiting = { ...PAGES, in_flight: [{ page_id: 'landing:contact', title: 'Contact', surface: 'landing', state: 'waiting_for_artist', state_word: 'Waiting for your review', since: day(1), stuck: false }] };
+    const s = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages': ok(waiting) }, queue: q });
+    await s.settle();
+    await s.click('st-status');
+    const overlay = s.el('st-panel');
+    overlay.fire('click', { target: overlay.querySelector('[data-review-page]'), preventDefault() {} });
+    await s.settle();
+    assert.equal(s.el('st-panel').hidden, true, 'the panel gives way to the card');
+    assert.deepEqual(JSON.parse(JSON.stringify(q.calls.open)).map((c) => c[0]), ['landing:contact']);
+    const low = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages': ok(waiting) }, queue: stubQueue(), rank: 'thetes' });
+    await low.settle();
+    await low.click('st-status');
+    assert.equal(low.el('st-panel-body').querySelector('[data-review-page]'), null, 'below metic the row opens the editor instead');
+  });
+
   await test('the Tweak/CopyWrite Flow: the recommendation, pick another swaps it, take it claims THAT page and opens it', async () => {
     const s = bootStudio({ answers: { ...HOME, 'POST /copy-desk/pages/builders:studio/claim': ok({ ok: true, outcome: 'created' }) } });
     await s.settle();
     await s.click('st-flow');
     assert.equal(s.el('st-panel').hidden, false);
     assert.ok(s.html.classList.contains('st-open'));
-    assert.equal(s.el('st-panel-title').textContent, 'Tweak/CopyWrite Flow');
+    assert.equal(s.el('st-panel-title').textContent, 'Work through tweaks');
     const body = () => s.el('st-panel-body').innerHTML;
     assert.match(body(), /st-next__page">Projects</);
     assert.match(body(), /landing · 2 people asked for it/);
@@ -346,7 +413,7 @@ try {
     await s.settle();
     await s.click('st-status');
     const body = s.el('st-panel-body').innerHTML;
-    assert.equal(s.el('st-panel-title').textContent, 'Artist Review Status');
+    assert.equal(s.el('st-panel-title').textContent, 'Needs to be reviewed');
     assert.deepEqual([...body.matchAll(/st-surface__name">([^<]*)</g)].map((m) => m[1]), ['Landing', 'Builders hall', 'Status']);
     assert.match(body, /st-surface__where">cloudbongos\.com</);
     assert.match(body, /1 of 2 tweaked/);

package/tests/hub_account_page.mjs

@@ -135,8 +135,8 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProjects')), [
     ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
-    // the Community menu's three sub-pages, folded into the band under 480px (task 1003363)
-    ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+    // the Community menu's four sub-pages, folded into the band under 480px (tasks 1003363, 1002981)
+    ['Leaderboard', '/community'], ['Builder of the week', '/community/week'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
     ['Builders you may know', '/connections#connSuggest'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [

package/tests/hub_community_page.mjs

@@ -1,10 +1,11 @@
 // tests/hub_community_page.mjs — the hub's community pages (task 1003363; ADR 0217 D1,
 // ADR 0337 D1/D3/D4.1, docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8).
 //
-// One file served as three sub-pages of the bar's Community menu (owner, 2026-10-27):
-// /community the leaderboard, /community/find the builder search, /community/recruiters
-// the name-only list of hidden builders open to recruiters. They render three existing
-// platform-identity reads and add no rule of their own. What this file pins:
+// One file served as four sub-pages of the bar's Community menu (owner, 2026-10-27):
+// /community the leaderboard, /community/week the builder of the week (task 1002981),
+// /community/find the builder search, /community/recruiters the name-only list of hidden
+// builders open to recruiters. They render existing platform-identity reads and add no
+// rule of their own. What this file pins:
 //   • the markup: the hub's bar with the Community menu as the current section, no top
 //     block, noindex, dark only, the routes' own windows and query limits
 //   • viewing is ungated: the leaderboard and the search read the same routes for every
@@ -13,11 +14,12 @@
 //     item marked current; the board in the server's order with its `place`, the window
 //     dropdown and the crafts, the empty, failed and rate-limited board; the search and
 //     its refusals; the recruiter list as a door signed out, a refusal on a 403, and rows
-//     only from a 200 — name, face and login, never the ranked half's numbers
+//     only from a 200 — name, face and login, never the ranked half's numbers; the builder
+//     of the week as one line on the board and as its own page, drawn as the server sent it
 //   • the Community menu on every page that wears the hub's bar (apex-only where the page
 //     also serves a child), folded into the Projects band on phones
-//   • the routes: the three paths served on the hub's apex only
-//   • the kit: the states files, and the stub answering as the three reads do
+//   • the routes: the four paths served on the hub's apex only
+//   • the kit: the states files, and the stub answering as the four reads do
 //
 // DB-free. Run:  node --test tests/hub_community_page.mjs
 
@@ -44,7 +46,8 @@ const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*
 const MAIN = PAGE.split('<main class="acct" id="comm">')[1].split('</main>')[0];
 const BOARD_JS = fs.readFileSync(path.join(PI, 'community-leaderboard.js'), 'utf8');
 const SEARCH_JS = fs.readFileSync(path.join(PI, 'builder-search.js'), 'utf8');
-const SUBPAGES = [['/community', 'Leaderboard'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+const SUBPAGES = [['/community', 'Leaderboard'], ['/community/week', 'Builder of the week'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+const WEEK_JS = fs.readFileSync(path.join(PI, 'builder-of-the-week.js'), 'utf8');
 
 // ── 1. the markup ────────────────────────────────────────────────────────────
 
@@ -72,7 +75,7 @@ test('the bar and bands are /connections’ but for the sign-in return and the c
 
 test('no top block: one visually hidden h1, then one section per sub-page, only the leaderboard shown in the markup', () => {
   assert.match(MAIN, /^\s*<h1 class="vh">Community<\/h1>\s*(<!--[\s\S]*?-->\s*)?<div class="mineExtra">/, 'nothing is drawn above the first section (the /design floor)');
-  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
+  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="week" data-view="week" aria-labelledby="weekH" hidden>', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
   assert.ok(order.every((i) => i > 0), 'every sub-page is real markup the script only shows');
   assert.deepEqual([...order].sort((a, b) => a - b), order);
   assert.match(MAIN, /<ol class="commRows" id="boardList" data-unit="\{\{currency\}\}" aria-labelledby="boardH"><\/ol>/, 'the unit is the instance’s own word, stamped by the server');
@@ -82,6 +85,23 @@ test('no top block: one visually hidden h1, then one section per sub-page, only
   assert.match(MAIN, /<h2 id="recruitH">Open to recruiters<\/h2>/, 'the hide flag is "hidden", never "private" (ADR 0337)');
   assert.match(MAIN, /<a class="btn" id="recruitSignin" href="\/api\/bongos\/auth\/web\/start\?return=\/community\/recruiters&amp;repos=1">/);
   for (const id of ['recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  // the builder of the week (task 1002981): its line on the board and its page wait for the read
+  assert.match(MAIN, /<h2 id="boardH">Leaderboard<\/h2>\n\s*<p class="commCrownLine" id="boardCrown" hidden><\/p>/, 'the crown line sits under the board’s heading, above the rows');
+  for (const id of ['weekCrown', 'weekNone', 'weekFailed', 'pastH']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  assert.match(MAIN, /<ol class="commRows weekRows" id="weekPast" aria-labelledby="pastH"><\/ol>/);
+});
+
+test('the builder of the week states its rule in full, and the rule is the module’s (spec D5: the formula is public)', () => {
+  const rule = MAIN.split('<h3 class="commSub" id="weekRuleH">How it is chosen</h3>')[1].split('<h3 ')[0];
+  assert.match(rule, /the most \{\{currency\}\} across every project in one week, Monday to Sunday \(UTC\)/, 'the instance’s own unit, the week the module counts');
+  assert.match(rule, /shipped at least one work that week/);
+  assert.match(WEEK_JS, /HAVING sum\(tasks_shipped\) >= 1/, 'the floor the page states is the one the query applies');
+  assert.match(rule, /A tie goes to whoever shipped more works, then to whoever earned more karma\./);
+  assert.match(WEEK_JS, /ORDER BY sum\(credits\) DESC, sum\(tasks_shipped\) DESC, sum\(karma\) DESC,/, 'the tie order the page states is the query’s');
+  assert.match(rule, /Builders who hide their numbers or keep their account private are not counted\./);
+  assert.match(WEEK_JS, /rollupVisibleSql\('pa'\)/);
+  assert.match(rule, /Each week is decided once, the first time anyone opens this page after it ends, and it does not change after that\./);
+  assert.match(WEEK_JS, /ON CONFLICT \(week_start\) DO NOTHING/);
 });
 
 test('the window dropdown and the query limits are the routes’ own (boundary-forced copies)', () => {
@@ -101,12 +121,12 @@ test('the window dropdown and the query limits are the routes’ own (boundary-f
   assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
 });
 
-test('the script builds no markup from strings, reads only the four routes, and never re-ranks or reads the ranked tier', () => {
+test('the script builds no markup from strings, reads only the five routes, and never re-ranks or reads the ranked tier', () => {
   assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
-  // every path literal in the code: the API base, the four reads, the three sub-pages, the
+  // every path literal in the code: the API base, the five reads, the four sub-pages, the
   // sign-in door and the hall's invite box the Recruit door opens (task 1002292)
   const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
-  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/my-projects', '/scouting']);
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/builder-of-the-week', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/community/week', '/my-projects', '/scouting']);
   assert.doesNotMatch(CODE, /method:/, 'it only reads');
   assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
   assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
@@ -147,7 +167,13 @@ const find = (n, cls) => {
 };
 
 const ROW = (place, handle, credits, extra = {}) => ({ place, handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: `https://avatars.example/${handle}`, credits, tasks_shipped: 2, karma: 1, disciplines: ['engineer'], ...extra });
+const WEEK = () => ({ week: { start: '2026-10-19', end: '2026-10-26' },
+  winner: { week_start: '2026-10-19', handle: 'ana', github_login: 'ana', display_name: 'Ana <i>L</i>', avatar_url: 'https://avatars.example/ana', credits: 1240, tasks_shipped: 1 },
+  past: [{ week_start: '2026-10-12', handle: 'bo', github_login: 'bo', display_name: null, avatar_url: 'data:x', credits: 300, tasks_shipped: 2 },
+    { week_start: '2026-09-28', handle: 'cy', github_login: 'cy', display_name: 'Cy', avatar_url: null, credits: 90, tasks_shipped: 1 },
+    { week_start: '2025-12-29', handle: 'di', github_login: 'di', display_name: 'Di', avatar_url: null, credits: 10, tasks_shipped: 1 }] });
 const READS = () => ({
+  '/community/builder-of-the-week': { status: 200, body: WEEK() },
   '/community/leaderboard?window=all': { status: 200, body: { window: 'all', count: 99, results: [ROW(26, 'ana', 1200), ROW(27, 'bo', 1500, { tasks_shipped: 1, karma: 0, avatar_url: 'javascript:alert(1)', display_name: null })] } },
   '/community/leaderboard?window=30d': { status: 200, body: { window: '30d', results: [ROW(1, 'cy', 40)] } },
   '/community/leaderboard?window=all&discipline=artist': { status: 200, body: { window: 'all', results: [] } },
@@ -199,9 +225,9 @@ async function boot({ pathname = '/community', me = null, reads = READS() } = {}
 }
 
 test('each path shows its one section, marks its menu items current and names itself; any other shape is the leaderboard', async () => {
-  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
+  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/week', 'Builder of the week', 'week'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
     const ui = await boot({ pathname });
-    assert.deepEqual(['board', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
+    assert.deepEqual(['board', 'week', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
     const href = SUBPAGES.find(([, t]) => t === title)[0];
     assert.deepEqual(ui.current(), [href, href], `${pathname}: its Community item and its folded twin in the Projects band`);
     assert.equal(ui.document.title, `Cloud Bongos — Community · ${title}`);
@@ -211,7 +237,7 @@ test('each path shows its one section, marks its menu items current and names it
 
 test('the leaderboard, signed out: the all-time board in the server’s order with the server’s places, and nothing asked about the viewer', async () => {
   const ui = await boot();
-  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all']);
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week']);
   assert.ok(ui.requests.every((r) => r.credentials === 'same-origin'));
   assert.equal(ui.$('boardLoading').hidden, true);
   assert.equal(ui.$('boardFailed').hidden, true);
@@ -229,7 +255,7 @@ test('the leaderboard, signed out: the all-time board in the server’s order wi
   assert.equal(find(bo, 'mineRow__hint').textContent, '1 work shipped · 0 karma');
   assert.equal(ui.$('boardNote').textContent, 'Credits earned across every project, since each builder started.');
   const signedIn = await boot({ me: { github_login: 'someone' } });
-  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects'], 'signed in, the same board read: viewing is ungated, and the one more read is the Recruit door’s');
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week', '/api/bongos/my-projects'], 'signed in, the same board read: viewing is ungated, and the one more read is the Recruit door’s');
   assert.equal(signedIn.$('boardList').textContent, ui.$('boardList').textContent, 'the same rows for every viewer');
 });
 
@@ -325,6 +351,76 @@ test('recruiters: a door signed out, a refusal on a 403, rows only from a 200 as
   assert.equal(failed.$('recruitFailed').textContent, 'This list could not be read. Reload the page to try again.');
 });
 
+// ── 2a. the builder of the week (task 1002981; spec D5) ──────────────────────
+// The server decides each week and records it; the page draws what it sent, the same for
+// every viewer: one line on the board, and its own page with the crown and the weeks before.
+
+test('the board’s crown line: the winner, their credits and the week, linking to its page; nothing on no winner or a failed read', async () => {
+  const ui = await boot();
+  const line = ui.$('boardCrown');
+  assert.equal(line.hidden, false);
+  assert.equal(line.textContent, 'Builder of the week: Ana <i>L</i>, ' + (1240).toLocaleString() + ' credits, 19–25 Oct', 'a name is text, never markup');
+  const link = kids(line)[0];
+  assert.equal(link.tag, 'a');
+  assert.equal(link.attrs.href, '/community/week');
+  assert.equal(kids(line)[2].tag, 'strong', 'the name stands out of the line');
+  const signedIn = await boot({ me: { github_login: 'someone' } });
+  assert.equal(signedIn.$('boardCrown').textContent, line.textContent, 'the same crown for every viewer');
+  for (const answer of [{ status: 200, body: { ...WEEK(), winner: null } }, { status: 500, body: {} }, { status: 429, body: {} }, { reject: true }]) {
+    const reads = READS();
+    reads['/community/builder-of-the-week'] = answer;
+    const quiet = await boot({ reads });
+    assert.equal(quiet.$('boardCrown').hidden, true, 'no winner to show, or no answer: no line');
+    assert.equal(quiet.$('boardCrown').textContent, '');
+    assert.equal(quiet.$('boardFailed').hidden, true, 'and never the board’s failure');
+    assert.equal(kids(quiet.$('boardList')).length, 2);
+  }
+});
+
+test('the week page: the crown, then the past weeks in the server’s order with their dates; nothing about projects asked', async () => {
+  const ui = await boot({ pathname: '/community/week', me: { github_login: 'owner' } });
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/builder-of-the-week'], 'one read: no board, and no Recruit door here');
+  assert.equal(ui.$('weekLoading').hidden, true);
+  assert.equal(ui.$('weekFailed').hidden, true);
+  assert.equal(ui.$('weekNone').hidden, true);
+  const crown = ui.$('weekCrown');
+  assert.equal(crown.hidden, false);
+  assert.equal(find(crown, 'crownWhen').textContent, '19–25 Oct 2026');
+  assert.equal(find(crown, 'crownName').textContent, 'Ana <i>L</i>');
+  assert.equal(find(crown, 'mineRow__host').textContent, '@ana');
+  assert.equal(find(crown, 'connAv').src, 'https://avatars.example/ana');
+  assert.equal(find(crown, 'crownNums').textContent, (1240).toLocaleString() + 'credits1work shipped', 'one work, singular');
+  assert.equal(ui.$('pastH').hidden, false);
+  const rows = kids(ui.$('weekPast'));
+  assert.deepEqual(rows.map((r) => find(r, 'commPlace').textContent), ['12–18 Oct', '28 Sep – 4 Oct', '29 Dec – 4 Jan'], 'newest first, as sent; a week across a month says both');
+  assert.equal(find(rows[0], 'mineRow__name').textContent, 'bo', 'no display name: the handle stands in');
+  assert.equal(find(rows[0], 'connAv').tag, 'span', 'an avatar that is not http(s) is never loaded');
+  assert.equal(find(rows[0], 'mineRow__hint').textContent, '2 works shipped');
+  assert.equal(find(rows[0], 'commNum').textContent, '300');
+  assert.equal(find(rows[0], 'commUnit').textContent, 'credits');
+  const out = await boot({ pathname: '/community/week' });
+  assert.equal(out.$('weekCrown').textContent, crown.textContent, 'the same page signed out');
+});
+
+test('the week page with no one to show, with no past weeks, and when the read fails', async () => {
+  const reads = READS();
+  reads['/community/builder-of-the-week'] = { status: 200, body: { week: { start: '2026-12-28', end: '2027-01-04' }, winner: null, past: [] } };
+  const none = await boot({ pathname: '/community/week', reads });
+  assert.equal(none.$('weekCrown').hidden, true);
+  assert.equal(none.$('weekNone').hidden, false);
+  assert.equal(none.$('weekNone').textContent, 'No builder of the week for 28 Dec 2026 – 3 Jan 2027.', 'a hidden winner and an empty week read the same (spec D8)');
+  assert.equal(none.$('pastH').hidden, true, 'no past weeks: no heading over nothing');
+  reads['/community/builder-of-the-week'] = { status: 200, body: { week: { start: 'soon' }, winner: null, past: [] } };
+  assert.equal((await boot({ pathname: '/community/week', reads })).$('weekNone').textContent, 'No builder of the week yet.', 'a date it cannot read is never drawn');
+  reads['/community/builder-of-the-week'] = { status: 500, body: {} };
+  const failed = await boot({ pathname: '/community/week', reads });
+  assert.equal(failed.$('weekFailed').hidden, false);
+  assert.equal(failed.$('weekFailed').textContent, 'The builder of the week could not be read. Reload the page to try again.');
+  assert.equal(failed.$('weekNone').hidden, true, 'a failure never reads as nobody this week');
+  reads['/community/builder-of-the-week'] = { status: 429, body: {} };
+  assert.match((await boot({ pathname: '/community/week', reads })).$('weekFailed').textContent, /^Too many requests/);
+});
+
 // ── 2b. the Recruit door (task 1002292; spec D6, owner 2026-10-27) ───────────
 // A project OWNER gets a Recruit link on each row: the hub cannot read a project's
 // `project.recruit` (ADR 0335 D1), so GET /my-projects' `owned` stands in. The link is the
@@ -342,7 +438,7 @@ test('recruit: an owner gets a Recruit link on every row but their own, opening
   const reads = READS();
   reads['/my-projects'] = OWNED(['mercury', 'https://mercury.example/x?y=1', 'Mercury']);
   const ui = await boot({ me: { github_login: 'BO' }, reads });
-  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects']);
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week', '/api/bongos/my-projects']);
   const [ana, bo] = kids(ui.$('boardList'));
   const a = recruitOf(ana);
   assert.equal(a.tag, 'a');
@@ -380,7 +476,7 @@ test('recruit: none for a builder who owns no project, signed out, on a failed r
   assert.equal(member.$('boardFor').hidden, true);
   assert.doesNotMatch(member.$('boardList').className, /canRecruit/);
   const out = await boot({ reads });
-  assert.deepEqual(out.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed out, nobody is asked about projects');
+  assert.deepEqual(out.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week'], 'signed out, nobody is asked about projects');
   for (const answer of [{ status: 500, body: {} }, { status: 401, body: {} }, { reject: true }, OWNED(['evil', 'javascript:alert(1)', 'Evil'], ['none', null, 'None'])]) {
     reads['/my-projects'] = answer;
     const ui = await boot({ me: { github_login: 'someone' }, reads });
@@ -440,6 +536,7 @@ const HUB_ONLY = ['account.html', 'connections.html', 'invitations.html', 'guild
 const wrap = (apex, s) => (apex ? `<!--apex-only:start-->${s}<!--apex-only:end-->` : s);
 const ITEMS = [
   ['/community', 'Leaderboard', 'who earned the most, across every project'],
+  ['/community/week', 'Builder of the week', 'the top earner of each week, and how it is chosen'],
   ['/community/find', 'Find a builder', 'anyone building here, by name or role'],
   ['/community/recruiters', 'Open to recruiters', 'who is open to recruiting, for project owners'],
 ];
@@ -460,9 +557,9 @@ test('every page that wears the hub’s bar carries the Community menu before Pr
     const at = html.indexOf(apex ? `<!--apex-only:start-->${trig}` : trig);
     assert.ok(at > 0, `${f}: the Community trigger`);
     assert.ok(html.indexOf('id="projTrig"') > at, `${f}: Community comes before Projects`);
-    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its three sub-pages`);
+    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its four sub-pages`);
     assert.ok(html.indexOf('id="menuCommunity"') < html.indexOf('id="menuProjects"'), `${f}: the bands in the bar’s order`);
-    assert.ok(html.includes(wrap(apex, fold)), `${f}: the three folded into the Projects band for phones`);
+    assert.ok(html.includes(wrap(apex, fold)), `${f}: the four folded into the Projects band for phones`);
     if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity|connSuggest/, `${f}: a child has no community pages, so no trace of the menu`);
   }
 });
@@ -520,7 +617,7 @@ function get(pathname, host) {
   });
 }
 
-test('GET /community, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
+test('GET /community, /community/week, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
   modules.setModuleOverrides({ 'platform-identity': false });
   for (const [p] of SUBPAGES) assert.equal((await get(p, 'game.test.local')).status, 404, `${p}: a child instance has none of the routes these pages read`);
   modules.setModuleOverrides({ 'platform-identity': true });
@@ -533,7 +630,7 @@ test('GET /community, /community/find and /community/recruiters: one stamped pag
     bodies.push(hub.body);
   }
   assert.ok(bodies.every((b) => b === bodies[0]), 'byte-identical for every sub-page: the script picks the view');
-  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the three sub-pages');
+  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the four sub-pages');
   for (const host of ['builders.test.local', 'status.test.local']) {
     assert.doesNotMatch((await get('/community', host)).body, /— Community<\/title>/, `${host} must not serve /community`);
   }
@@ -546,15 +643,18 @@ test('the kit renders each sub-page for everyone, the empty board, and a project
   const states = json('community.states.json');
   assert.equal(states.page, '/community');
   assert.deepEqual(states.modes, ['dark']);
-  for (const s of ['out', 'out-30d', 'out-artists', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
+  for (const s of ['out', 'out-30d', 'out-artists', 'out-week', 'in-week', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
   assert.equal(states.states['out-find'].url, '/community/find');
+  assert.equal(states.states['out-week'].url, '/community/week');
+  assert.ok(states.states.out.expect.visible.includes('#boardCrown'), 'the board carries the crown line');
   assert.equal(states.states['in-recruiters'].url, '/community/recruiters');
   assert.ok(states.states['in-recruiters'].expect.visible.includes('#recruitClosed'), 'signed in but not admitted: told, shown no one');
-  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter'], ['community-owner.states.json', 'my-projects', 'my-projects-owner'], ['community-owner-two.states.json', 'my-projects', 'my-projects-owner-two']]) {
+  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter'], ['community-owner.states.json', 'my-projects', 'my-projects-owner'], ['community-owner-two.states.json', 'my-projects', 'my-projects-owner-two'], ['community-week-none.states.json', 'community-week', 'community-week-none']]) {
     assert.equal(json(file).stub.fixtures[name], fixture);
     assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
   }
   assert.equal(json('community-recruiter.states.json').states['in-recruiter'].url, '/community/recruiters');
+  assert.equal(json('community-week-none.states.json').states['out-week-none'].url, '/community/week');
   // the Recruit door (task 1002292): an owner of one project on the board and the search, and of two with the choice
   assert.ok(json('community-owner.states.json').states['in-owner'].expect.count.some(([sel, n]) => sel === '#boardList a.commRecruit' && n === 6));
   assert.equal(json('community-owner.states.json').states['in-owner-find'].url, '/community/find');
@@ -585,9 +685,14 @@ async function call(origin, p) {
   return { status: res.status, body: await res.json() };
 }
 
-test('the kit stub answers the board, the search and the recruiting door the way the routes do', async () => {
+test('the kit stub answers the board, the builder of the week, the search and the recruiting door the way the routes do', async () => {
   const s = await stub();
   try {
+    const week = await call(s.origin, '/community/builder-of-the-week');
+    assert.deepEqual(Object.keys(week.body).sort(), ['past', 'week', 'winner'], 'the route’s three keys');
+    assert.ok(week.body.winner && week.body.past.length, 'a crown and the weeks before it');
+    assert.ok([week.body.winner, ...week.body.past].every((r) => !('github_id' in r) && Object.keys(r).sort().join() === 'avatar_url,credits,display_name,github_login,handle,tasks_shipped,week_start'), 'the module’s projection, no github_id');
+    assert.deepEqual(week.body.past.map((p) => p.week_start), [...week.body.past.map((p) => p.week_start)].sort().reverse(), 'newest first');
     const all = await call(s.origin, '/community/leaderboard');
     assert.equal(all.body.window, 'all');
     assert.deepEqual(all.body.results.map((r) => r.place), all.body.results.map((_, i) => i + 1));
@@ -606,6 +711,12 @@ test('the kit stub answers the board, the search and the recruiting door the way
   try {
     assert.equal((await call(member.origin, '/scouting')).status, 403, 'signed in, most builders are refused');
   } finally { member.stop(); }
+  const none = await stub({ FIXTURE_ALIAS: JSON.stringify({ 'community-week': 'community-week-none' }) });
+  try {
+    const r = await call(none.origin, '/community/builder-of-the-week');
+    assert.equal(r.body.winner, null);
+    assert.deepEqual(r.body.past, []);
+  } finally { none.stop(); }
   const owner = await stub({ AUTH: '1', FIXTURE_ALIAS: JSON.stringify({ scouting: 'scouting-recruiter' }) });
   try {
     const r = await call(owner.origin, '/scouting');

package/tests/landing_legal_pages.mjs

@@ -193,8 +193,8 @@ for (const p of PAGES) {
     assert.deepEqual(bandLinks(bandOf(html, 'menuProjects')), [
       ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
-      // the Community menu's three sub-pages, folded into the band under 480px (task 1003363); apex-only
-      ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+      // the Community menu's four sub-pages, folded into the band under 480px (tasks 1003363, 1002981); apex-only
+      ['Leaderboard', '/community'], ['Builder of the week', '/community/week'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
       ['Builders you may know', '/connections#connSuggest'],
     ], 'this page has no views of its own, so every item names /projects in full');
     assert.deepEqual(bandLinks(bandOf(stripApexOnly(html, false), 'menuProjects')).map((l) => l[0]), ['Sky', 'Table', 'Your projects', 'New project'], 'a child has no /community');

package/tests/privacy_matrix.mjs

@@ -150,6 +150,10 @@ function identitySentinels(acct) {
 //                'listed' | 'name-only' (listed, disciplines null) | 'absent'
 //   board      GET /community/leaderboard   Anon · Builder — the cross-project leaderboard
 //                'listed' | 'absent'
+//   week       GET /community/builder-of-the-week   Anon · Builder · Recruiter — the crown and
+//                the past weeks (task 1002981, spec D5): a row IS stats, so the board's rule.
+//                Every fixture account has won a recorded week, so the read's own predicate
+//                decides: 'listed' | 'absent'
 //   directory  GET /scouting                Recruiter — 'full' | 'name-only' | 'absent'
 //   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
 //   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
@@ -166,13 +170,13 @@ function identitySentinels(acct) {
 //                people the guild page already shows them — shown_publicly AND existence;
 //                hide_stats never hides membership, and private or provisional is never listed
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
 };
 
 // ===========================================================================
@@ -280,6 +284,19 @@ function guildRosterFilter(sql, params) {
 // origin the hall links point at.
 const MX_CLIENT = { client_id: 'mx-proj', secret_hash: '', name: 'MX Project', redirect_uris: [], origin: 'https://mx-proj.example', owner_github_id: null, status: 'active' };
 
+// THE WEEKS each fixture account won (task 1002981): PUB the week now crowned, every
+// other account a week before it, so the crown and the past list both carry a cell.
+// Lazy: the module may only load after the pool is pinned below, through the routes.
+let weeksWon = null;
+function weekOf(key) {
+  if (!weeksWon) {
+    const { crownedWeek } = require('../modules/platform-identity/builder-of-the-week.js');
+    weeksWon = Object.fromEntries(['PUB', ...KEYS.filter((k) => k !== 'PUB')].map((k, i) =>
+      [k, new Date(crownedWeek().start.getTime() - i * 7 * 24 * 60 * 60 * 1000).toISOString().slice(0, 10)]));
+  }
+  return weeksWon[key];
+}
+
 const pool = {
   query: async (text, params = []) => {
     const sql = String(text).replace(/\s+/g, ' ').trim();
@@ -338,6 +355,21 @@ const pool = {
     // ... and the weekly totals: never computed on a read (guild-totals.js); none stored here.
     if (/FROM platform_identity_guild_totals WHERE guild_id = \$1$/.test(sql)) return { rows: [], rowCount: 0 };
 
+    // BUILDER OF THE WEEK (task 1002981): every week is already recorded (no crowning
+    // here), one per fixture account, PUB the current one — so the read's own predicate
+    // decides who is shown. The projection is pinned: a new column is a new disclosure.
+    if (/^SELECT 1 FROM platform_identity_weekly_features WHERE week_start = \$1::date$/.test(sql)) return { rows: [{ '?column?': 1 }], rowCount: 1 };
+    if (/FROM platform_identity_weekly_features f JOIN platform_identity_accounts pa/.test(sql)) {
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      if (cols !== "to_char(f.week_start, 'YYYY-MM-DD') AS week_start, f.credits_delta, f.ships_delta, pa.handle, pa.github_login, pa.display_name, pa.avatar_url") throw new Error(`fake pool: the builder-of-the-week read selects something new — ${cols}`);
+      const where = lift(sql, /WHERE f\.week_start <= \$1::date AND (.+?) ORDER BY/, 'builder of the week');
+      const rows = ACCOUNTS.filter(accountFilter(where, [])).map((a) => ({
+        week_start: weekOf(a.key), credits_delta: String(ROLLUP[a.github_id].credits), ships_delta: String(ROLLUP[a.github_id].works_shipped),
+        handle: a.handle, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url,
+      })).sort((x, y) => (x.week_start < y.week_start ? 1 : -1)).slice(0, params[1]);
+      return { rows, rowCount: rows.length };
+    }
+
     // THE LEADERBOARD's totals: the rollup floor sits on the act CTE's join.
     if (/platform_identity_activity_snapshots/.test(sql)) {
       const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'leaderboard totals');
@@ -764,6 +796,19 @@ test('the cross-project leaderboard — only shown, public, active accounts, the
   }
 });
 
+test('the builder of the week — only shown, public, active winners, on the crown and the past weeks, the same for every viewer', async () => {
+  const seen = [];
+  for (const who of [ANON, STRANGER, RECRUITER]) seen.push(await get(who, '/api/bongos/community/builder-of-the-week'));
+  for (const r of seen.slice(1)) assert.equal(r.text, seen[0].text, `${r.who} got a different builder of the week`);
+  const { winner, past } = seen[0].json;
+  assert.equal(winner && winner.handle, ACCT.PUB.handle, 'control: a shown winner is crowned, or absence below is vacuous');
+  const listed = new Set([winner, ...past].filter(Boolean).map((x) => x.handle));
+  for (const k of KEYS) {
+    assert.equal(listed.has(ACCT[k].handle), MATRIX[k].week === 'listed', `${k}: expected ${MATRIX[k].week}`);
+  }
+  assert.doesNotMatch(seen[0].text, /github_id/, 'github_id never crosses');
+});
+
 test('the recruiting directory — the recruiter sees the full and name-only tiers; Anon and Builder are refused', async () => {
   const r = await get(RECRUITER, '/api/bongos/scouting');
   assert.equal(r.status, 200);
@@ -806,7 +851,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/community/builder-of-the-week', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);