@bongos/core 1.23.14 → 1.23.15

package/tests/builder_of_the_week_db.mjs

@@ -0,0 +1,166 @@
+// tests/builder_of_the_week_db.mjs — task 1002981 (community spec D5; real DB).
+//
+// Proves Builder of the Week against real SQL: which snapshots open and close the
+// week, the shipped-work floor, the tie order, the leaderboard's eligibility, that
+// the first decision is pinned (a later change, a hide, a race) and that a week
+// nobody won is recorded empty. A fake pool can only prove the statements' shape
+// (tests/builder_of_the_week.mjs).
+//
+// The crown is global (every eligible builder on the hub), so every fixture week is
+// in 2099: a shared database's real builders have no snapshot there, their week's
+// delta is zero, and the shipped-work floor keeps them out.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/builder_of_the_week_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const { readBuilderOfTheWeek, crownedWeek, clearCrownMemo } = require('../modules/platform-identity/builder-of-the-week.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`builder_of_the_week_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const A = 90298101, B = 90298102, C = 90298103, D = 90298104;
+const HIDDEN = 90298105, PRIVATE = 90298106, E = 90298107;
+const IDS = [A, B, C, D, E, HIDDEN, PRIVATE];
+const P1 = 't1002981-p1', P2 = 't1002981-p2';
+const DAY = 24 * 60 * 60 * 1000;
+const NOW = new Date('2099-03-12T10:00:00.000Z');
+const { start, end } = crownedWeek(NOW);
+const at = (base, ms) => new Date(base.getTime() + ms);
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_weekly_features WHERE week_start >= '2099-01-01'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+}
+async function account(id, handle, { visibility = 'public', hide = false } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, handle, profile_state, account_visibility, hide_stats, terms_accepted_at)
+     VALUES ($1, $2, $2, $2, 'active', $3, $4, now())`,
+    [id, handle, visibility, hide],
+  );
+}
+// The live row (its numbers do not matter to a past week; first seen long before the
+// week unless said) and a history of snapshots.
+async function builder(id, client, history, firstSeen = at(start, -365 * DAY)) {
+  await q(`INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma, first_seen_at) VALUES ($1, $2, 0, 0, 0, $3)`, [client, id, firstSeen]);
+  for (const [when, credits, ships, karma] of history) {
+    await q(
+      `INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) VALUES ($1, $2, $3, $4, $5, $6)`,
+      [client, id, credits, ships, karma, when],
+    );
+  }
+}
+const recorded = async (week) => (await q(
+  `SELECT github_id::text AS github_id, credits_delta::int AS credits, ships_delta::int AS ships FROM platform_identity_weekly_features WHERE week_start = $1::date`,
+  [week],
+)).rows;
+const read = (now = NOW) => { clearCrownMemo(); return readBuilderOfTheWeek({ now, pool }); };
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_005_builder_activity.sql',
+    'platform_identity_007_profile_consent.sql', 'platform_identity_008_handle.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_032_weekly_features.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  await account(A, 't1002981-a');
+  await account(B, 't1002981-b');
+  await account(C, 't1002981-c');
+  await account(D, 't1002981-d');
+  await account(E, 't1002981-e');
+  await account(HIDDEN, 't1002981-hidden', { hide: true });
+  await account(PRIVATE, 't1002981-private', { visibility: 'private' });
+
+  // A: 350 credits, 3 works, no karma — across two projects. P1 has a snapshot before
+  // the week (the baseline); P2 has none but was first seen in the week (counts from
+  // zero). A snapshot a second AFTER the week closes is not the week's.
+  await builder(A, P1, [[at(start, -3 * DAY), 100, 5, 4], [at(start, 2 * DAY), 400, 7, 4], [at(end, 1000), 99999, 99, 4]]);
+  await builder(A, P2, [[at(start, 3 * DAY), 50, 1, 0]], at(start, 3 * DAY));
+  // E: a lifetime brought into the week — no history before it, and seen before it (or
+  // before first_seen_at existed, NULL). Counting from zero would crown E; neither counts.
+  await builder(E, P1, [[at(start, DAY), 90000, 40, 0]], null);
+  await builder(E, P2, [[at(start, DAY), 90000, 40, 0]]);
+  // C: the same credits and works as A, two more karma — C beats A on karma.
+  await builder(C, P1, [[at(start, -DAY), 0, 0, 0], [at(start, DAY), 360, 3, 2]]);
+  // D: the same credits, the most karma, but one work fewer — works come before karma.
+  await builder(D, P1, [[at(start, -DAY), 0, 0, 0], [at(start, DAY), 350, 2, 9]]);
+  // B: the most credits, but no work shipped in the week (the floor).
+  await builder(B, P1, [[at(start, -DAY), 0, 4, 0], [at(start, DAY), 900, 4, 0]]);
+  // HIDDEN and PRIVATE out-earn everyone, and the leaderboard may not show them.
+  await builder(HIDDEN, P1, [[at(start, -DAY), 0, 0, 0], [at(start, DAY), 5000, 5, 0]]);
+  await builder(PRIVATE, P1, [[at(start, -DAY), 0, 0, 0], [at(start, DAY), 5000, 5, 0]]);
+  // A snapshot exactly at the start belongs to the baseline: C's week is 360 - 10, not 360.
+  await q(`INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) VALUES ($1, $2, 10, 0, 0, $3)`, [P1, C, start]);
+
+  // 1 — the crown, and the row that records it
+  const first = await read();
+  same(first.week, { start: start.toISOString().slice(0, 10), end: end.toISOString().slice(0, 10) }, 'the week is the last full Monday-to-Monday week');
+  same(first.winner && [first.winner.handle, first.winner.credits, first.winner.tasks_shipped], ['t1002981-c', 350, 3], 'ties go to works shipped, then karma; no work, hidden, private and a lifetime brought into the week never win');
+  ok(!('github_id' in first.winner), 'github_id never crosses');
+  same(await recorded(first.week.start), [{ github_id: String(C), credits: 350, ships: 3 }], 'the week is recorded on the first read');
+
+  // 2 — pinned: a later report into the past week, or a builder who goes public, changes nothing
+  await q(`INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) VALUES ($1, $2, 99999, 50, 0, $3)`, [P1, A, at(start, 4 * DAY)]);
+  await q(`UPDATE platform_identity_accounts SET hide_stats = false WHERE github_id = $1`, [HIDDEN]);
+  same((await read()).winner.handle, 't1002981-c', 'the first decision stands');
+  await q(`UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1`, [HIDDEN]);
+
+  // 3 — a winner who hides is not shown, and their week goes to nobody else
+  await q(`UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1`, [C]);
+  same((await read()).winner, null, 'a hidden winner is not drawn');
+  same(await recorded(first.week.start), [{ github_id: String(C), credits: 350, ships: 3 }], 'and the row is never re-crowned');
+
+  // 4 — a later week nobody shipped in (two on, past A's late snapshot) is recorded empty;
+  // the crowned week is in its past list once its winner is shown again
+  const next = at(NOW, 14 * DAY);
+  const empty = await read(next);
+  same(empty.winner, null, 'a week nobody won has no crown');
+  same(await recorded(empty.week.start), [{ github_id: null, credits: 0, ships: 0 }], 'and is recorded empty, so it stays empty');
+  same(empty.past, [], 'the week before is left out while its winner hides');
+  await q(`UPDATE platform_identity_accounts SET hide_stats = false WHERE github_id = $1`, [C]);
+  same((await read(next)).past.map((p) => [p.week_start, p.handle]), [[first.week.start, 't1002981-c']], 'shown again, it is back in the past weeks');
+
+  // 5 — two hub processes crowning the same week at once: one row, no error
+  const third = at(NOW, 21 * DAY);
+  const other = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+  try {
+    clearCrownMemo();
+    const both = await Promise.all([readBuilderOfTheWeek({ now: third, pool }), readBuilderOfTheWeek({ now: third, pool: other })]);
+    same(both.map((b) => b.winner), [null, null], 'both answer');
+    same((await recorded(both[0].week.start)).length, 1, 'one row: ON CONFLICT DO NOTHING');
+  } finally { await other.end().catch(() => {}); }
+
+  console.log(`\nbuilder_of_the_week_db.mjs: ${pass} passed`);
+} finally {
+  clearCrownMemo();
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/hub_account_page.mjs

@@ -135,8 +135,8 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProjects')), [
     ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
-    // the Community menu's three sub-pages, folded into the band under 480px (task 1003363)
-    ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+    // the Community menu's four sub-pages, folded into the band under 480px (tasks 1003363, 1002981)
+    ['Leaderboard', '/community'], ['Builder of the week', '/community/week'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
     ['Builders you may know', '/connections#connSuggest'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [

package/tests/hub_community_page.mjs

@@ -1,10 +1,11 @@
 // tests/hub_community_page.mjs — the hub's community pages (task 1003363; ADR 0217 D1,
 // ADR 0337 D1/D3/D4.1, docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8).
 //
-// One file served as three sub-pages of the bar's Community menu (owner, 2026-10-27):
-// /community the leaderboard, /community/find the builder search, /community/recruiters
-// the name-only list of hidden builders open to recruiters. They render three existing
-// platform-identity reads and add no rule of their own. What this file pins:
+// One file served as four sub-pages of the bar's Community menu (owner, 2026-10-27):
+// /community the leaderboard, /community/week the builder of the week (task 1002981),
+// /community/find the builder search, /community/recruiters the name-only list of hidden
+// builders open to recruiters. They render existing platform-identity reads and add no
+// rule of their own. What this file pins:
 //   • the markup: the hub's bar with the Community menu as the current section, no top
 //     block, noindex, dark only, the routes' own windows and query limits
 //   • viewing is ungated: the leaderboard and the search read the same routes for every
@@ -13,11 +14,12 @@
 //     item marked current; the board in the server's order with its `place`, the window
 //     dropdown and the crafts, the empty, failed and rate-limited board; the search and
 //     its refusals; the recruiter list as a door signed out, a refusal on a 403, and rows
-//     only from a 200 — name, face and login, never the ranked half's numbers
+//     only from a 200 — name, face and login, never the ranked half's numbers; the builder
+//     of the week as one line on the board and as its own page, drawn as the server sent it
 //   • the Community menu on every page that wears the hub's bar (apex-only where the page
 //     also serves a child), folded into the Projects band on phones
-//   • the routes: the three paths served on the hub's apex only
-//   • the kit: the states files, and the stub answering as the three reads do
+//   • the routes: the four paths served on the hub's apex only
+//   • the kit: the states files, and the stub answering as the four reads do
 //
 // DB-free. Run:  node --test tests/hub_community_page.mjs
 
@@ -44,7 +46,8 @@ const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*
 const MAIN = PAGE.split('<main class="acct" id="comm">')[1].split('</main>')[0];
 const BOARD_JS = fs.readFileSync(path.join(PI, 'community-leaderboard.js'), 'utf8');
 const SEARCH_JS = fs.readFileSync(path.join(PI, 'builder-search.js'), 'utf8');
-const SUBPAGES = [['/community', 'Leaderboard'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+const SUBPAGES = [['/community', 'Leaderboard'], ['/community/week', 'Builder of the week'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+const WEEK_JS = fs.readFileSync(path.join(PI, 'builder-of-the-week.js'), 'utf8');
 
 // ── 1. the markup ────────────────────────────────────────────────────────────
 
@@ -72,7 +75,7 @@ test('the bar and bands are /connections’ but for the sign-in return and the c
 
 test('no top block: one visually hidden h1, then one section per sub-page, only the leaderboard shown in the markup', () => {
   assert.match(MAIN, /^\s*<h1 class="vh">Community<\/h1>\s*(<!--[\s\S]*?-->\s*)?<div class="mineExtra">/, 'nothing is drawn above the first section (the /design floor)');
-  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
+  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="week" data-view="week" aria-labelledby="weekH" hidden>', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
   assert.ok(order.every((i) => i > 0), 'every sub-page is real markup the script only shows');
   assert.deepEqual([...order].sort((a, b) => a - b), order);
   assert.match(MAIN, /<ol class="commRows" id="boardList" data-unit="\{\{currency\}\}" aria-labelledby="boardH"><\/ol>/, 'the unit is the instance’s own word, stamped by the server');
@@ -82,6 +85,23 @@ test('no top block: one visually hidden h1, then one section per sub-page, only
   assert.match(MAIN, /<h2 id="recruitH">Open to recruiters<\/h2>/, 'the hide flag is "hidden", never "private" (ADR 0337)');
   assert.match(MAIN, /<a class="btn" id="recruitSignin" href="\/api\/bongos\/auth\/web\/start\?return=\/community\/recruiters&amp;repos=1">/);
   for (const id of ['recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  // the builder of the week (task 1002981): its line on the board and its page wait for the read
+  assert.match(MAIN, /<h2 id="boardH">Leaderboard<\/h2>\n\s*<p class="commCrownLine" id="boardCrown" hidden><\/p>/, 'the crown line sits under the board’s heading, above the rows');
+  for (const id of ['weekCrown', 'weekNone', 'weekFailed', 'pastH']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  assert.match(MAIN, /<ol class="commRows weekRows" id="weekPast" aria-labelledby="pastH"><\/ol>/);
+});
+
+test('the builder of the week states its rule in full, and the rule is the module’s (spec D5: the formula is public)', () => {
+  const rule = MAIN.split('<h3 class="commSub" id="weekRuleH">How it is chosen</h3>')[1].split('<h3 ')[0];
+  assert.match(rule, /the most \{\{currency\}\} across every project in one week, Monday to Sunday \(UTC\)/, 'the instance’s own unit, the week the module counts');
+  assert.match(rule, /shipped at least one work that week/);
+  assert.match(WEEK_JS, /HAVING sum\(tasks_shipped\) >= 1/, 'the floor the page states is the one the query applies');
+  assert.match(rule, /A tie goes to whoever shipped more works, then to whoever earned more karma\./);
+  assert.match(WEEK_JS, /ORDER BY sum\(credits\) DESC, sum\(tasks_shipped\) DESC, sum\(karma\) DESC,/, 'the tie order the page states is the query’s');
+  assert.match(rule, /Builders who hide their numbers or keep their account private are not counted\./);
+  assert.match(WEEK_JS, /rollupVisibleSql\('pa'\)/);
+  assert.match(rule, /Each week is decided once, the first time anyone opens this page after it ends, and it does not change after that\./);
+  assert.match(WEEK_JS, /ON CONFLICT \(week_start\) DO NOTHING/);
 });
 
 test('the window dropdown and the query limits are the routes’ own (boundary-forced copies)', () => {
@@ -101,12 +121,12 @@ test('the window dropdown and the query limits are the routes’ own (boundary-f
   assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
 });
 
-test('the script builds no markup from strings, reads only the four routes, and never re-ranks or reads the ranked tier', () => {
+test('the script builds no markup from strings, reads only the five routes, and never re-ranks or reads the ranked tier', () => {
   assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
-  // every path literal in the code: the API base, the four reads, the three sub-pages, the
+  // every path literal in the code: the API base, the five reads, the four sub-pages, the
   // sign-in door and the hall's invite box the Recruit door opens (task 1002292)
   const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
-  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/my-projects', '/scouting']);
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/builder-of-the-week', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/community/week', '/my-projects', '/scouting']);
   assert.doesNotMatch(CODE, /method:/, 'it only reads');
   assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
   assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
@@ -147,7 +167,13 @@ const find = (n, cls) => {
 };
 
 const ROW = (place, handle, credits, extra = {}) => ({ place, handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: `https://avatars.example/${handle}`, credits, tasks_shipped: 2, karma: 1, disciplines: ['engineer'], ...extra });
+const WEEK = () => ({ week: { start: '2026-10-19', end: '2026-10-26' },
+  winner: { week_start: '2026-10-19', handle: 'ana', github_login: 'ana', display_name: 'Ana <i>L</i>', avatar_url: 'https://avatars.example/ana', credits: 1240, tasks_shipped: 1 },
+  past: [{ week_start: '2026-10-12', handle: 'bo', github_login: 'bo', display_name: null, avatar_url: 'data:x', credits: 300, tasks_shipped: 2 },
+    { week_start: '2026-09-28', handle: 'cy', github_login: 'cy', display_name: 'Cy', avatar_url: null, credits: 90, tasks_shipped: 1 },
+    { week_start: '2025-12-29', handle: 'di', github_login: 'di', display_name: 'Di', avatar_url: null, credits: 10, tasks_shipped: 1 }] });
 const READS = () => ({
+  '/community/builder-of-the-week': { status: 200, body: WEEK() },
   '/community/leaderboard?window=all': { status: 200, body: { window: 'all', count: 99, results: [ROW(26, 'ana', 1200), ROW(27, 'bo', 1500, { tasks_shipped: 1, karma: 0, avatar_url: 'javascript:alert(1)', display_name: null })] } },
   '/community/leaderboard?window=30d': { status: 200, body: { window: '30d', results: [ROW(1, 'cy', 40)] } },
   '/community/leaderboard?window=all&discipline=artist': { status: 200, body: { window: 'all', results: [] } },
@@ -199,9 +225,9 @@ async function boot({ pathname = '/community', me = null, reads = READS() } = {}
 }
 
 test('each path shows its one section, marks its menu items current and names itself; any other shape is the leaderboard', async () => {
-  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
+  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/week', 'Builder of the week', 'week'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
     const ui = await boot({ pathname });
-    assert.deepEqual(['board', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
+    assert.deepEqual(['board', 'week', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
     const href = SUBPAGES.find(([, t]) => t === title)[0];
     assert.deepEqual(ui.current(), [href, href], `${pathname}: its Community item and its folded twin in the Projects band`);
     assert.equal(ui.document.title, `Cloud Bongos — Community · ${title}`);
@@ -211,7 +237,7 @@ test('each path shows its one section, marks its menu items current and names it
 
 test('the leaderboard, signed out: the all-time board in the server’s order with the server’s places, and nothing asked about the viewer', async () => {
   const ui = await boot();
-  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all']);
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week']);
   assert.ok(ui.requests.every((r) => r.credentials === 'same-origin'));
   assert.equal(ui.$('boardLoading').hidden, true);
   assert.equal(ui.$('boardFailed').hidden, true);
@@ -229,7 +255,7 @@ test('the leaderboard, signed out: the all-time board in the server’s order wi
   assert.equal(find(bo, 'mineRow__hint').textContent, '1 work shipped · 0 karma');
   assert.equal(ui.$('boardNote').textContent, 'Credits earned across every project, since each builder started.');
   const signedIn = await boot({ me: { github_login: 'someone' } });
-  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects'], 'signed in, the same board read: viewing is ungated, and the one more read is the Recruit door’s');
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week', '/api/bongos/my-projects'], 'signed in, the same board read: viewing is ungated, and the one more read is the Recruit door’s');
   assert.equal(signedIn.$('boardList').textContent, ui.$('boardList').textContent, 'the same rows for every viewer');
 });
 
@@ -325,6 +351,76 @@ test('recruiters: a door signed out, a refusal on a 403, rows only from a 200 as
   assert.equal(failed.$('recruitFailed').textContent, 'This list could not be read. Reload the page to try again.');
 });
 
+// ── 2a. the builder of the week (task 1002981; spec D5) ──────────────────────
+// The server decides each week and records it; the page draws what it sent, the same for
+// every viewer: one line on the board, and its own page with the crown and the weeks before.
+
+test('the board’s crown line: the winner, their credits and the week, linking to its page; nothing on no winner or a failed read', async () => {
+  const ui = await boot();
+  const line = ui.$('boardCrown');
+  assert.equal(line.hidden, false);
+  assert.equal(line.textContent, 'Builder of the week: Ana <i>L</i>, ' + (1240).toLocaleString() + ' credits, 19–25 Oct', 'a name is text, never markup');
+  const link = kids(line)[0];
+  assert.equal(link.tag, 'a');
+  assert.equal(link.attrs.href, '/community/week');
+  assert.equal(kids(line)[2].tag, 'strong', 'the name stands out of the line');
+  const signedIn = await boot({ me: { github_login: 'someone' } });
+  assert.equal(signedIn.$('boardCrown').textContent, line.textContent, 'the same crown for every viewer');
+  for (const answer of [{ status: 200, body: { ...WEEK(), winner: null } }, { status: 500, body: {} }, { status: 429, body: {} }, { reject: true }]) {
+    const reads = READS();
+    reads['/community/builder-of-the-week'] = answer;
+    const quiet = await boot({ reads });
+    assert.equal(quiet.$('boardCrown').hidden, true, 'no winner to show, or no answer: no line');
+    assert.equal(quiet.$('boardCrown').textContent, '');
+    assert.equal(quiet.$('boardFailed').hidden, true, 'and never the board’s failure');
+    assert.equal(kids(quiet.$('boardList')).length, 2);
+  }
+});
+
+test('the week page: the crown, then the past weeks in the server’s order with their dates; nothing about projects asked', async () => {
+  const ui = await boot({ pathname: '/community/week', me: { github_login: 'owner' } });
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/builder-of-the-week'], 'one read: no board, and no Recruit door here');
+  assert.equal(ui.$('weekLoading').hidden, true);
+  assert.equal(ui.$('weekFailed').hidden, true);
+  assert.equal(ui.$('weekNone').hidden, true);
+  const crown = ui.$('weekCrown');
+  assert.equal(crown.hidden, false);
+  assert.equal(find(crown, 'crownWhen').textContent, '19–25 Oct 2026');
+  assert.equal(find(crown, 'crownName').textContent, 'Ana <i>L</i>');
+  assert.equal(find(crown, 'mineRow__host').textContent, '@ana');
+  assert.equal(find(crown, 'connAv').src, 'https://avatars.example/ana');
+  assert.equal(find(crown, 'crownNums').textContent, (1240).toLocaleString() + 'credits1work shipped', 'one work, singular');
+  assert.equal(ui.$('pastH').hidden, false);
+  const rows = kids(ui.$('weekPast'));
+  assert.deepEqual(rows.map((r) => find(r, 'commPlace').textContent), ['12–18 Oct', '28 Sep – 4 Oct', '29 Dec – 4 Jan'], 'newest first, as sent; a week across a month says both');
+  assert.equal(find(rows[0], 'mineRow__name').textContent, 'bo', 'no display name: the handle stands in');
+  assert.equal(find(rows[0], 'connAv').tag, 'span', 'an avatar that is not http(s) is never loaded');
+  assert.equal(find(rows[0], 'mineRow__hint').textContent, '2 works shipped');
+  assert.equal(find(rows[0], 'commNum').textContent, '300');
+  assert.equal(find(rows[0], 'commUnit').textContent, 'credits');
+  const out = await boot({ pathname: '/community/week' });
+  assert.equal(out.$('weekCrown').textContent, crown.textContent, 'the same page signed out');
+});
+
+test('the week page with no one to show, with no past weeks, and when the read fails', async () => {
+  const reads = READS();
+  reads['/community/builder-of-the-week'] = { status: 200, body: { week: { start: '2026-12-28', end: '2027-01-04' }, winner: null, past: [] } };
+  const none = await boot({ pathname: '/community/week', reads });
+  assert.equal(none.$('weekCrown').hidden, true);
+  assert.equal(none.$('weekNone').hidden, false);
+  assert.equal(none.$('weekNone').textContent, 'No builder of the week for 28 Dec 2026 – 3 Jan 2027.', 'a hidden winner and an empty week read the same (spec D8)');
+  assert.equal(none.$('pastH').hidden, true, 'no past weeks: no heading over nothing');
+  reads['/community/builder-of-the-week'] = { status: 200, body: { week: { start: 'soon' }, winner: null, past: [] } };
+  assert.equal((await boot({ pathname: '/community/week', reads })).$('weekNone').textContent, 'No builder of the week yet.', 'a date it cannot read is never drawn');
+  reads['/community/builder-of-the-week'] = { status: 500, body: {} };
+  const failed = await boot({ pathname: '/community/week', reads });
+  assert.equal(failed.$('weekFailed').hidden, false);
+  assert.equal(failed.$('weekFailed').textContent, 'The builder of the week could not be read. Reload the page to try again.');
+  assert.equal(failed.$('weekNone').hidden, true, 'a failure never reads as nobody this week');
+  reads['/community/builder-of-the-week'] = { status: 429, body: {} };
+  assert.match((await boot({ pathname: '/community/week', reads })).$('weekFailed').textContent, /^Too many requests/);
+});
+
 // ── 2b. the Recruit door (task 1002292; spec D6, owner 2026-10-27) ───────────
 // A project OWNER gets a Recruit link on each row: the hub cannot read a project's
 // `project.recruit` (ADR 0335 D1), so GET /my-projects' `owned` stands in. The link is the
@@ -342,7 +438,7 @@ test('recruit: an owner gets a Recruit link on every row but their own, opening
   const reads = READS();
   reads['/my-projects'] = OWNED(['mercury', 'https://mercury.example/x?y=1', 'Mercury']);
   const ui = await boot({ me: { github_login: 'BO' }, reads });
-  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/my-projects']);
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week', '/api/bongos/my-projects']);
   const [ana, bo] = kids(ui.$('boardList'));
   const a = recruitOf(ana);
   assert.equal(a.tag, 'a');
@@ -380,7 +476,7 @@ test('recruit: none for a builder who owns no project, signed out, on a failed r
   assert.equal(member.$('boardFor').hidden, true);
   assert.doesNotMatch(member.$('boardList').className, /canRecruit/);
   const out = await boot({ reads });
-  assert.deepEqual(out.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed out, nobody is asked about projects');
+  assert.deepEqual(out.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week'], 'signed out, nobody is asked about projects');
   for (const answer of [{ status: 500, body: {} }, { status: 401, body: {} }, { reject: true }, OWNED(['evil', 'javascript:alert(1)', 'Evil'], ['none', null, 'None'])]) {
     reads['/my-projects'] = answer;
     const ui = await boot({ me: { github_login: 'someone' }, reads });
@@ -440,6 +536,7 @@ const HUB_ONLY = ['account.html', 'connections.html', 'invitations.html', 'guild
 const wrap = (apex, s) => (apex ? `<!--apex-only:start-->${s}<!--apex-only:end-->` : s);
 const ITEMS = [
   ['/community', 'Leaderboard', 'who earned the most, across every project'],
+  ['/community/week', 'Builder of the week', 'the top earner of each week, and how it is chosen'],
   ['/community/find', 'Find a builder', 'anyone building here, by name or role'],
   ['/community/recruiters', 'Open to recruiters', 'who is open to recruiting, for project owners'],
 ];
@@ -460,9 +557,9 @@ test('every page that wears the hub’s bar carries the Community menu before Pr
     const at = html.indexOf(apex ? `<!--apex-only:start-->${trig}` : trig);
     assert.ok(at > 0, `${f}: the Community trigger`);
     assert.ok(html.indexOf('id="projTrig"') > at, `${f}: Community comes before Projects`);
-    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its three sub-pages`);
+    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its four sub-pages`);
     assert.ok(html.indexOf('id="menuCommunity"') < html.indexOf('id="menuProjects"'), `${f}: the bands in the bar’s order`);
-    assert.ok(html.includes(wrap(apex, fold)), `${f}: the three folded into the Projects band for phones`);
+    assert.ok(html.includes(wrap(apex, fold)), `${f}: the four folded into the Projects band for phones`);
     if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity|connSuggest/, `${f}: a child has no community pages, so no trace of the menu`);
   }
 });
@@ -520,7 +617,7 @@ function get(pathname, host) {
   });
 }
 
-test('GET /community, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
+test('GET /community, /community/week, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
   modules.setModuleOverrides({ 'platform-identity': false });
   for (const [p] of SUBPAGES) assert.equal((await get(p, 'game.test.local')).status, 404, `${p}: a child instance has none of the routes these pages read`);
   modules.setModuleOverrides({ 'platform-identity': true });
@@ -533,7 +630,7 @@ test('GET /community, /community/find and /community/recruiters: one stamped pag
     bodies.push(hub.body);
   }
   assert.ok(bodies.every((b) => b === bodies[0]), 'byte-identical for every sub-page: the script picks the view');
-  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the three sub-pages');
+  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the four sub-pages');
   for (const host of ['builders.test.local', 'status.test.local']) {
     assert.doesNotMatch((await get('/community', host)).body, /— Community<\/title>/, `${host} must not serve /community`);
   }
@@ -546,15 +643,18 @@ test('the kit renders each sub-page for everyone, the empty board, and a project
   const states = json('community.states.json');
   assert.equal(states.page, '/community');
   assert.deepEqual(states.modes, ['dark']);
-  for (const s of ['out', 'out-30d', 'out-artists', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
+  for (const s of ['out', 'out-30d', 'out-artists', 'out-week', 'in-week', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
   assert.equal(states.states['out-find'].url, '/community/find');
+  assert.equal(states.states['out-week'].url, '/community/week');
+  assert.ok(states.states.out.expect.visible.includes('#boardCrown'), 'the board carries the crown line');
   assert.equal(states.states['in-recruiters'].url, '/community/recruiters');
   assert.ok(states.states['in-recruiters'].expect.visible.includes('#recruitClosed'), 'signed in but not admitted: told, shown no one');
-  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter'], ['community-owner.states.json', 'my-projects', 'my-projects-owner'], ['community-owner-two.states.json', 'my-projects', 'my-projects-owner-two']]) {
+  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter'], ['community-owner.states.json', 'my-projects', 'my-projects-owner'], ['community-owner-two.states.json', 'my-projects', 'my-projects-owner-two'], ['community-week-none.states.json', 'community-week', 'community-week-none']]) {
     assert.equal(json(file).stub.fixtures[name], fixture);
     assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
   }
   assert.equal(json('community-recruiter.states.json').states['in-recruiter'].url, '/community/recruiters');
+  assert.equal(json('community-week-none.states.json').states['out-week-none'].url, '/community/week');
   // the Recruit door (task 1002292): an owner of one project on the board and the search, and of two with the choice
   assert.ok(json('community-owner.states.json').states['in-owner'].expect.count.some(([sel, n]) => sel === '#boardList a.commRecruit' && n === 6));
   assert.equal(json('community-owner.states.json').states['in-owner-find'].url, '/community/find');
@@ -585,9 +685,14 @@ async function call(origin, p) {
   return { status: res.status, body: await res.json() };
 }
 
-test('the kit stub answers the board, the search and the recruiting door the way the routes do', async () => {
+test('the kit stub answers the board, the builder of the week, the search and the recruiting door the way the routes do', async () => {
   const s = await stub();
   try {
+    const week = await call(s.origin, '/community/builder-of-the-week');
+    assert.deepEqual(Object.keys(week.body).sort(), ['past', 'week', 'winner'], 'the route’s three keys');
+    assert.ok(week.body.winner && week.body.past.length, 'a crown and the weeks before it');
+    assert.ok([week.body.winner, ...week.body.past].every((r) => !('github_id' in r) && Object.keys(r).sort().join() === 'avatar_url,credits,display_name,github_login,handle,tasks_shipped,week_start'), 'the module’s projection, no github_id');
+    assert.deepEqual(week.body.past.map((p) => p.week_start), [...week.body.past.map((p) => p.week_start)].sort().reverse(), 'newest first');
     const all = await call(s.origin, '/community/leaderboard');
     assert.equal(all.body.window, 'all');
     assert.deepEqual(all.body.results.map((r) => r.place), all.body.results.map((_, i) => i + 1));
@@ -606,6 +711,12 @@ test('the kit stub answers the board, the search and the recruiting door the way
   try {
     assert.equal((await call(member.origin, '/scouting')).status, 403, 'signed in, most builders are refused');
   } finally { member.stop(); }
+  const none = await stub({ FIXTURE_ALIAS: JSON.stringify({ 'community-week': 'community-week-none' }) });
+  try {
+    const r = await call(none.origin, '/community/builder-of-the-week');
+    assert.equal(r.body.winner, null);
+    assert.deepEqual(r.body.past, []);
+  } finally { none.stop(); }
   const owner = await stub({ AUTH: '1', FIXTURE_ALIAS: JSON.stringify({ scouting: 'scouting-recruiter' }) });
   try {
     const r = await call(owner.origin, '/scouting');

package/tests/landing_legal_pages.mjs

@@ -193,8 +193,8 @@ for (const p of PAGES) {
     assert.deepEqual(bandLinks(bandOf(html, 'menuProjects')), [
       ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
-      // the Community menu's three sub-pages, folded into the band under 480px (task 1003363); apex-only
-      ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+      // the Community menu's four sub-pages, folded into the band under 480px (tasks 1003363, 1002981); apex-only
+      ['Leaderboard', '/community'], ['Builder of the week', '/community/week'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
       ['Builders you may know', '/connections#connSuggest'],
     ], 'this page has no views of its own, so every item names /projects in full');
     assert.deepEqual(bandLinks(bandOf(stripApexOnly(html, false), 'menuProjects')).map((l) => l[0]), ['Sky', 'Table', 'Your projects', 'New project'], 'a child has no /community');