@bongos/core 1.23.17 → 1.23.19

package/modules/public-landing/public/projects.html

@@ -858,7 +858,8 @@ summary{min-height:24px;padding:3px 0;}
 <!--apex-only:start--><div class="menuBand" id="menuCommunity" data-menu="community" hidden>
   <div class="bandIn">
     <ul class="bandRow">
-      <li class="bandCell"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
+      <li class="bandCell"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li>
+      <li class="bandCell"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
       <li class="bandCell"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li>
       <li class="bandCell"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li>
       <li class="bandCell"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li>
@@ -875,7 +876,7 @@ summary{min-height:24px;padding:3px 0;}
       <li class="bandCell"><a class="bandT" href="?view=map&amp;sub=table" data-nav="map" data-sub="table">Table</a><span class="bandC">the same projects as rows</span></li>
       <li class="bandCell"><a class="bandT" href="?view=mine" data-nav="mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="?view=new" data-nav="new">New project</a><span class="bandC">five questions and a home</span></li>
-      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
+      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
     </ul>
     <!-- About and Docs are site pages, not project views: they live in the
          footer row with Privacy / Terms / Contact (owner, 2026-08-28; task 1003332). -->

package/modules/public-landing/public/terms.html

@@ -69,7 +69,8 @@
 <!--apex-only:start--><div class="menuBand" id="menuCommunity" data-menu="community" hidden>
   <div class="bandIn">
     <ul class="bandRow">
-      <li class="bandCell"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
+      <li class="bandCell"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li>
+      <li class="bandCell"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
       <li class="bandCell"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li>
       <li class="bandCell"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li>
       <li class="bandCell"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li>
@@ -84,7 +85,7 @@
       <li class="bandCell"><a class="bandT" href="/projects?view=map&amp;sub=table">Table</a><span class="bandC">the same projects as rows</span></li>
       <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
-      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
+      <!--apex-only:start--><li class="bandCell bandFold"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li><!--apex-only:end-->
     </ul>
   </div>
 </div>

package/modules/ui-design/kit/fixtures/community-crowns-first.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/crowns in late October 2026 (task 1004902), what the hub shows until the first month is crowned: September began before snapshot history did, so it is not crowned and the answer names 1 November, the day October is.",
+  "week": { "start": "2026-10-19", "end": "2026-10-26", "winner": { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 1240, "tasks_shipped": 4 } },
+  "month": { "start": "2026-09-01", "end": "2026-10-01", "first_crown": "2026-11-01", "winner": null },
+  "year": { "start": "2026-01-01", "since": "2026-09-27", "last": null, "winner": { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "credits": 7400, "tasks_shipped": 27 } }
+}

package/modules/ui-design/kit/fixtures/community-crowns-new-year.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/crowns in early January 2027 (task 1004902): 2026 has been crowned for good and shows as last year under the new year so far; history began before 2027, so the year counts from 1 January.",
+  "week": { "start": "2027-01-04", "end": "2027-01-11", "winner": { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 980, "tasks_shipped": 3 } },
+  "month": { "start": "2026-12-01", "end": "2027-01-01", "first_crown": null, "winner": { "handle": "tomas-ek", "github_login": "tomasek", "display_name": "Tomas Ek", "avatar_url": "/__kit/avatar.svg", "credits": 4400, "tasks_shipped": 15 } },
+  "year": { "start": "2027-01-01", "since": "2027-01-01", "winner": { "handle": "lin-wei", "github_login": "linwei", "display_name": "Lin Wei", "avatar_url": null, "credits": 310, "tasks_shipped": 2 }, "last": { "start": "2026-01-01", "winner": { "handle": "maximiliana-van-der-berghe-lindqvist", "github_login": "mvdbl", "display_name": "Maximiliana van der Berghe-Lindqvist", "avatar_url": "/__kit/avatar.svg", "credits": 11250, "tasks_shipped": 38 } } }
+}

package/modules/ui-design/kit/fixtures/community-crowns-none.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/crowns with no one to show (task 1004902): nobody qualified, or each winner hides their numbers — the two look the same (spec D8).",
+  "week": { "start": "2026-10-26", "end": "2026-11-02", "winner": null },
+  "month": { "start": "2026-10-01", "end": "2026-11-01", "first_crown": null, "winner": null },
+  "year": { "start": "2026-01-01", "since": "2026-09-27", "last": null, "winner": null }
+}

package/modules/ui-design/kit/fixtures/community-crowns.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/crowns for the kit stub (task 1004902): the week, the month and the year as community-crowns.js answers in early November 2026 — October crowned, the year so far counted since snapshot history began on 27 Sep. Names are invented; the year's long one tests a card's wrap.",
+  "week": { "start": "2026-10-26", "end": "2026-11-02", "winner": { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 1240, "tasks_shipped": 4 } },
+  "month": { "start": "2026-10-01", "end": "2026-11-01", "first_crown": null, "winner": { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "credits": 6120, "tasks_shipped": 23 } },
+  "year": { "start": "2026-01-01", "since": "2026-09-27", "last": null, "winner": { "handle": "maximiliana-van-der-berghe-lindqvist", "github_login": "mvdbl", "display_name": "Maximiliana van der Berghe-Lindqvist", "avatar_url": "/__kit/avatar.svg", "credits": 9870, "tasks_shipped": 31 } }
+}

package/modules/ui-design/kit/serve.js

@@ -736,6 +736,19 @@ function communityWeek(res, origin) {
   if (stubStatus(res, f)) return;
   return json(res, 200, { week: f.week, winner: f.winner ? withAvatar(f.winner, origin) : null, past: (f.past || []).map((r) => withAvatar(r, origin)) });
 }
+// The crowns (task 1004902): the fixture is already the route's answer — the week, month
+// and year, each with its winner or null (community-crowns.js).
+function communityCrowns(res, origin) {
+  const f = heldFixture('community-crowns');
+  if (stubStatus(res, f)) return;
+  const shown = (w) => (w ? withAvatar(w, origin) : null);
+  const year = f.year || {};
+  return json(res, 200, {
+    week: { ...f.week, winner: shown(f.week && f.week.winner) },
+    month: { ...f.month, winner: shown(f.month && f.month.winner) },
+    year: { ...year, winner: shown(year.winner), last: year.last ? { ...year.last, winner: shown(year.last.winner) } : null },
+  });
+}
 function scoutingRead(res, origin) {
   const f = heldFixture('scouting');
   if (stubStatus(res, f)) return;
@@ -774,6 +787,7 @@ const server = http.createServer((req, res) => {
     if (rest === '/community/leaderboard' && req.method === 'GET') return communityBoard(res, u, origin);
     if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);
     if (rest === '/community/builder-of-the-week' && req.method === 'GET') return communityWeek(res, origin);
+    if (rest === '/community/crowns' && req.method === 'GET') return communityCrowns(res, origin);
     if (rest === '/scouting' && req.method === 'GET') return AUTH ? scoutingRead(res, origin) : json(res, 401, UNAUTH);
     if (rest === '/connections' && req.method === 'GET') return AUTH ? connRead(res, 'list', origin) : json(res, 401, UNAUTH);
     if (rest === '/connections/requests' && req.method === 'GET') return AUTH ? connRead(res, 'requests', origin) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.17",
+  "version": "1.23.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.17",
+      "version": "1.23.19",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.17",
+  "version": "1.23.19",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10491,5 +10491,17 @@
       "id": "1004899",
       "text": "Page tweak rounds that hold nothing to do now close themselves after an hour, so the Studio no longer shows empty rounds as needing a look forever."
     }
+  ],
+  "1.23.18": [
+    {
+      "id": "1004901",
+      "text": "Every stage of a page tweak now has a named person and a deadline. Drafts left alone get a reminder after a week and close after two, so no page sits in the Studio without someone being told."
+    }
+  ],
+  "1.23.19": [
+    {
+      "id": "1004902",
+      "text": "The community page now opens on a Community home: the builder of the week, of the month and of the year side by side, how they are chosen, and a button to each community page. The leaderboard has its own page now, and Communit"
+    }
   ]
 }

package/scripts/bongos/run-unit-tests.js

@@ -75,6 +75,10 @@ const INTEGRATION = new Set([
   // close the week, the shipped-work floor and tie order, and the ON CONFLICT pin
   // under two racing writers. The DB-free sibling is builder_of_the_week.
   'builder_of_the_week_db',
+  // task 1004902: the builders of the month and the year against real SQL — the month
+  // keeps the week's baseline rule, the year counts from a row's first snapshot inside
+  // it, the pin under a hide and two racing writers. The DB-free sibling is community_crowns.
+  'community_crowns_db',
   // bfg, bfg_write, memory_isolation, memory_pull and setup_smoke LEFT this set under task
   // 1004865: none of them ever needed a database. Each failed on a stale test harness (a fake
   // server without res.fail, a stub on the wrong module, an old error shape, a renamed session

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.19'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -338,11 +338,12 @@ function buildPlatformApp() {
     res.type('html').send(html);
   });
   // THE COMMUNITY PAGES (task 1003363, ADR 0217 D1, ADR 0337 D1/D3): who is building
-  // across every project — the leaderboard, the builder of the week (task 1002981), the
+  // across every project — the community home with the builders of the week, month and
+  // year (task 1004902), the leaderboard, the builder of the week (task 1002981), the
   // builder search (the same for every viewer) and the recruiter list GET /scouting's own
-  // door admits. One file serves all four; its script shows the one the path names.
+  // door admits. One file serves all five; its script shows the one the path names.
   // Hub-only for the /account reason: every read it makes is a platform-identity route.
-  app.get(['/community', '/community/week', '/community/find', '/community/recruiters'], (req, res, next) => {
+  app.get(['/community', '/community/leaderboard', '/community/week', '/community/find', '/community/recruiters'], (req, res, next) => {
     if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
     const html = landingPage('community.html');
     if (!html) return next();

package/tests/community_crowns.mjs

@@ -0,0 +1,369 @@
+// tests/community_crowns.mjs — the builders of the week, the month and the year behind the
+// hub's /community page (task 1004902).
+//
+// DB-free. A fake pool answers each statement by its shape. Which snapshots open and close
+// a month or a year, and that the year's first-snapshot baseline really counts, need a real
+// Postgres: tests/community_crowns_db.mjs.
+//
+// What this pins:
+//   1. the month: the last FULL calendar month (UTC) before now, at every edge.
+//   2. history: a month that began before snapshot history is not crowned, and the answer
+//      names the day the first month will be; no history at all crowns nothing.
+//   3. the month crowned like the week: the week's statement, written once and never
+//      overwritten, crowned once however many reads arrive, read back through the
+//      leaderboard's numbers predicate.
+//   4. the year: live from 1 January with the first-snapshot baseline, memoised for
+//      LEADER_TTL_MS, `since` while history starts inside the year, the leader shown only if
+//      still eligible, asked on every read; the year that ended
+//      crowned on the first read of the next, by the same rule, and shown as `last`.
+//   5. the answer: the three periods, no github_id anywhere.
+//   6. the route: no-store, the same body with or without credentials, the 500 envelope,
+//      and its own rate-limit scope.
+//
+// Run:  node tests/community_crowns.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+const { rollupVisibleSql } = require('../modules/platform-identity/account-visibility.js');
+const NUMBERS = rollupVisibleSql('pa').replace(/\s+/g, ' ').trim();
+
+// ---- fake engine ------------------------------------------------------------
+
+const WEEK_PROBE = /^SELECT 1 FROM platform_identity_weekly_features WHERE week_start = \$1::date$/;
+const isWeekInsert = (sql) => /^INSERT INTO platform_identity_weekly_features/.test(sql);
+const isWeekRead = (sql) => /FROM platform_identity_weekly_features f\s+JOIN platform_identity_accounts pa/.test(sql);
+const HISTORY = /^SELECT reported_at FROM platform_identity_activity_snapshots ORDER BY id ASC LIMIT 1$/;
+const PERIOD_PROBE = /^SELECT 1 FROM platform_identity_period_features WHERE period = \$1 AND period_start = \$2::date$/;
+const isWinner = (sql) => /^WITH act AS/.test(sql);
+const isYearRule = (sql) => /\) f ON true/.test(sql);
+const isPeriodInsert = (sql) => /^INSERT INTO platform_identity_period_features/.test(sql);
+const isPeriodRead = (sql) => /FROM platform_identity_period_features f JOIN platform_identity_accounts pa/.test(sql);
+const isLeaderRead = (sql) => /FROM platform_identity_accounts pa WHERE pa\.github_id = \$1::bigint/.test(sql);
+const iso = (d) => (d instanceof Date ? d.toISOString() : String(d));
+
+const engine = {
+  calls: [],
+  history: null,        // the first snapshot's reported_at, or null
+  periods: new Set(),   // 'month:2026-10-01' rows the probe finds
+  winners: {},          // 'month' | 'year' | 'week' → the winner statement's row
+  periodShown: {},      // 'month:2026-10-01' → the read's row (already filtered)
+  accounts: {},         // github_id → the leader read's row (already filtered)
+  weekShown: [],
+  throwOn: null,
+  slowWinner: false,
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    engine.calls.push({ sql, params });
+    if (engine.throwOn && engine.throwOn(sql)) { engine.throwOn = null; throw new Error('boom'); }
+    if (WEEK_PROBE.test(sql)) return { rows: [{ '?column?': 1 }] };
+    if (isWeekRead(sql)) return { rows: engine.weekShown };
+    if (isWeekInsert(sql)) return { rows: [], rowCount: 1 };
+    if (HISTORY.test(sql)) return { rows: engine.history ? [{ reported_at: engine.history }] : [] };
+    if (PERIOD_PROBE.test(sql)) return { rows: engine.periods.has(`${params[0]}:${params[1]}`) ? [{ '?column?': 1 }] : [] };
+    if (isWinner(sql)) {
+      if (engine.slowWinner) await new Promise((r) => setTimeout(r, 10));
+      const w = engine.winners[isYearRule(sql) ? 'year' : 'month'];
+      return { rows: w ? [w] : [] };
+    }
+    if (isPeriodInsert(sql)) { engine.periods.add(`${params[0]}:${params[1]}`); return { rows: [], rowCount: 1 }; }
+    if (isPeriodRead(sql)) { const r = engine.periodShown[`${params[0]}:${params[1]}`]; return { rows: r ? [r] : [] }; }
+    if (isLeaderRead(sql)) { const r = engine.accounts[params[0]]; return { rows: r ? [r] : [] }; }
+    throw new Error(`fake pool: unexpected statement ${sql.slice(0, 80)}`);
+  },
+};
+function reset() {
+  Object.assign(engine, {
+    calls: [], history: null, periods: new Set(), winners: {}, periodShown: {}, accounts: {},
+    weekShown: [], throwOn: null, slowWinner: false,
+  });
+  botw.clearCrownMemo();
+  crowns.clearCrownsMemo();
+}
+const callsOf = (pred) => engine.calls.filter((c) => pred(c.sql));
+
+// Pin the module doorway (ADR 0083) BEFORE the modules load.
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool: engine,
+    corsPublicGet: () => (_req, res, next) => { res.set('Access-Control-Allow-Origin', '*'); next(); },
+    logger: () => ({ error: () => {}, info: () => {}, warn: () => {} }),
+  },
+};
+
+const botw = require('../modules/platform-identity/builder-of-the-week.js');
+const crowns = require('../modules/platform-identity/community-crowns.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildRoutes = require('../modules/platform-identity/routes/community-leaderboard.js');
+
+const HISTORY_BEGAN = '2026-09-27T14:05:00.000Z';
+const row = (handle, credits, ships) => ({ handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: null, credits_delta: String(credits), ships_delta: String(ships) });
+const acct = (handle) => ({ handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: null });
+const read = (now) => crowns.readCrowns({ now: new Date(now), pool: engine });
+
+// ---- 1. the month -----------------------------------------------------------
+
+await t('the crowned month is the last full calendar month (UTC) before now, at every edge', () => {
+  const month = (now) => { const m = crowns.crownedMonth(new Date(now)); return [m.start.toISOString(), m.end.toISOString()]; };
+  const oct = ['2026-10-01T00:00:00.000Z', '2026-11-01T00:00:00.000Z'];
+  assert.deepEqual(month('2026-11-17T09:30:00.000Z'), oct, 'mid-month: the month before this one');
+  assert.deepEqual(month('2026-11-01T00:00:00.000Z'), oct, 'the very first instant of the 1st: the month that just ended');
+  assert.deepEqual(month('2026-11-30T23:59:59.999Z'), oct, 'the last instant of the month: still the same one');
+  assert.deepEqual(month('2026-10-31T23:59:59.999Z'), ['2026-09-01T00:00:00.000Z', '2026-10-01T00:00:00.000Z'], 'the month ending tonight is not over yet');
+  assert.deepEqual(month('2027-01-04T12:00:00.000Z'), ['2026-12-01T00:00:00.000Z', '2027-01-01T00:00:00.000Z'], 'across a year');
+});
+
+// ---- 2. history ----------------------------------------------------------------
+
+await t('a month that began before snapshot history is not crowned; the answer names the first crown', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  const out = await read('2026-10-28T09:30:00.000Z');
+  assert.deepEqual(out.month, { start: '2026-09-01', end: '2026-10-01', winner: null, first_crown: '2026-11-01' });
+  assert.equal(callsOf((s) => PERIOD_PROBE.test(s) && /month/.test(s)).length, 0);
+  assert.equal(callsOf(isPeriodInsert).length, 0, 'nothing recorded: no month is "nobody" for want of data');
+  assert.equal(callsOf((s) => isWinner(s) && !isYearRule(s)).length, 0);
+});
+
+await t('history that begins on the 1st makes that month the first one', async () => {
+  reset();
+  engine.history = '2026-10-01T00:00:00.000Z';
+  assert.equal((await read('2026-10-28T09:30:00.000Z')).month.first_crown, '2026-11-01');
+  reset();
+  engine.history = '2026-10-01T00:00:00.000Z';
+  const nov = await read('2026-11-02T00:00:00.000Z');
+  assert.equal(nov.month.first_crown, null);
+  assert.deepEqual(callsOf(isPeriodInsert).map((c) => c.params.slice(0, 2)), [['month', '2026-10-01']]);
+});
+
+await t('no history at all: nothing computed, nothing written, no first crown to name', async () => {
+  reset();
+  const out = await read('2026-11-02T00:00:00.000Z');
+  assert.deepEqual(out.month, { start: '2026-10-01', end: '2026-11-01', winner: null, first_crown: null });
+  assert.deepEqual(out.year, { start: '2026-01-01', since: '2026-01-01', winner: null, last: null });
+  assert.equal(callsOf(isWinner).length, 0);
+  assert.equal(callsOf(isPeriodInsert).length, 0);
+});
+
+await t('history is asked once per process once it exists, and again while it does not', async () => {
+  reset();
+  await read('2026-10-28T09:30:00.000Z');
+  await read('2026-10-28T09:31:00.000Z');
+  assert.equal(callsOf((s) => HISTORY.test(s)).length, 2, 'no history yet: asked every time');
+  engine.history = HISTORY_BEGAN;
+  await read('2026-10-28T09:32:00.000Z');
+  await read('2026-10-28T09:33:00.000Z');
+  assert.equal(callsOf((s) => HISTORY.test(s)).length, 3);
+});
+
+// ---- 3. the month crowned like the week -------------------------------------------
+
+await t('the month: the week’s statement and rule, written once and never overwritten', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.month = { github_id: '42', credits: '900', tasks_shipped: '3' };
+  await read('2026-11-03T08:00:00.000Z');
+  const [w] = callsOf((s) => isWinner(s) && !isYearRule(s));
+  assert.ok(w.sql.includes(NUMBERS), 'the leaderboard’s numbers predicate');
+  assert.match(w.sql, /HAVING sum\(tasks_shipped\) >= 1/);
+  assert.match(w.sql, /\) b ON true WHERE b\.credits IS NOT NULL OR act\.first_seen_at >= \$1::timestamptz \)/, 'the week’s baseline rule: no lifetime in one month');
+  assert.deepEqual(w.params.map(iso), ['2026-10-01T00:00:00.000Z', '2026-11-01T00:00:00.000Z']);
+  const [ins] = callsOf(isPeriodInsert);
+  assert.match(ins.sql, /ON CONFLICT \(period, period_start\) DO NOTHING$/, 'the first decision stands');
+  assert.doesNotMatch(ins.sql, /DO UPDATE/);
+  assert.deepEqual(ins.params, ['month', '2026-10-01', '42', '900', '3']);
+});
+
+await t('a month nobody won is written with no winner, so it stays empty', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  const out = await read('2026-11-03T08:00:00.000Z');
+  assert.deepEqual(callsOf(isPeriodInsert)[0].params, ['month', '2026-10-01', null, 0, 0]);
+  assert.equal(out.month.winner, null);
+});
+
+await t('a recorded month is never recomputed, and an unrecorded one is crowned once however many reads arrive', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.periods.add('month:2026-10-01');
+  await read('2026-11-03T08:00:00.000Z');
+  assert.equal(callsOf((s) => isWinner(s) && !isYearRule(s)).length, 0);
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.slowWinner = true;
+  engine.winners.month = { github_id: '7', credits: '50', tasks_shipped: '1' };
+  await Promise.all([1, 2, 3, 4].map(() => read('2026-11-03T08:00:00.000Z')));
+  assert.equal(callsOf((s) => isWinner(s) && !isYearRule(s)).length, 1);
+  assert.equal(callsOf((s) => isPeriodInsert(s)).length, 1);
+  assert.equal(callsOf(isPeriodRead).length, 4, 'every read still reads the crown');
+});
+
+await t('the month read: the numbers predicate at read time; a winner who hid since is not drawn', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.periods.add('month:2026-10-01');
+  engine.periodShown['month:2026-10-01'] = row('ana', 1240, 4);
+  const out = await read('2026-11-03T08:00:00.000Z');
+  const [r] = callsOf(isPeriodRead);
+  assert.ok(r.sql.includes(NUMBERS));
+  assert.doesNotMatch(r.sql.match(/^SELECT (.+?) FROM /)[1], /github_id/, 'github_id never crosses');
+  assert.deepEqual(out.month.winner, { handle: 'ana', github_login: 'ana', display_name: 'ANA', avatar_url: null, credits: 1240, tasks_shipped: 4 });
+  delete engine.periodShown['month:2026-10-01'];
+  assert.equal((await read('2026-11-03T08:00:00.000Z')).month.winner, null);
+});
+
+// ---- 4. the year ----------------------------------------------------------------
+
+await t('the year so far: live from 1 January, counting a row with no earlier history from its first snapshot', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  engine.accounts['9'] = acct('cy');
+  const out = await read('2026-10-28T09:30:00.000Z');
+  const [y] = callsOf(isYearRule);
+  assert.ok(y.sql.includes(NUMBERS));
+  assert.match(y.sql, /COALESCE\(e\.credits, 0\)::bigint - COALESCE\(b\.credits, CASE WHEN act\.first_seen_at >= \$1::timestamptz THEN 0 ELSE f\.credits END, 0\) AS credits/);
+  assert.match(y.sql, /AND s\.reported_at > \$1::timestamptz AND s\.reported_at <= \$2::timestamptz ORDER BY s\.reported_at ASC, s\.id ASC LIMIT 1 \) f ON true/, 'the first snapshot inside the year');
+  assert.match(y.sql, /WHERE b\.credits IS NOT NULL OR act\.first_seen_at >= \$1::timestamptz OR f\.credits IS NOT NULL \)/);
+  assert.deepEqual(y.params.map(iso), ['2026-01-01T00:00:00.000Z', '2026-10-28T09:30:00.000Z']);
+  const [l] = callsOf(isLeaderRead);
+  assert.ok(l.sql.includes(NUMBERS), 'the leader is shown only while eligible');
+  assert.deepEqual(out.year, {
+    start: '2026-01-01', since: '2026-09-27', last: null,
+    winner: { handle: 'cy', github_login: 'cy', display_name: 'CY', avatar_url: null, credits: 3000, tasks_shipped: 12 },
+  });
+  assert.equal(callsOf((s) => isPeriodInsert(s)).length, 0, 'a year so far is never written');
+});
+
+await t('the year so far is recomputed once its memo is older than LEADER_TTL_MS, and a leader who cannot be shown is no leader', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  assert.equal((await read('2026-10-28T09:30:00.000Z')).year.winner, null);
+  engine.accounts['9'] = acct('cy');
+  assert.equal((await read('2026-10-28T09:31:00.000Z')).year.winner.handle, 'cy');
+  assert.equal(callsOf(isYearRule).length, 2);
+});
+
+await t('inside the memo the leader is not recomputed, but whether they may be shown is asked every read', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  engine.accounts['9'] = acct('cy');
+  const t0 = Date.parse('2026-10-28T09:30:00.000Z');
+  assert.equal((await read(t0)).year.winner.handle, 'cy');
+  delete engine.accounts['9']; // the leader hides
+  assert.equal((await read(t0 + crowns.LEADER_TTL_MS - 1)).year.winner, null, 'a hide beats the memo');
+  assert.equal(callsOf(isYearRule).length, 1, 'one computation inside the memo');
+  assert.equal(callsOf(isLeaderRead).length, 2, 'the visibility read every time');
+  await read(t0 + crowns.LEADER_TTL_MS);
+  assert.equal(callsOf(isYearRule).length, 2, 'and a fresh one once it is stale');
+  await read(t0 - 1000);
+  assert.equal(callsOf(isYearRule).length, 3, 'a clock that runs backwards is never served from the memo');
+});
+
+await t('the year that ended is crowned on the first read of the next, by the year’s rule, and shown as last', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  engine.accounts['9'] = acct('cy');
+  engine.periodShown['year:2026-01-01'] = row('cy', 3100, 13);
+  const out = await read('2027-01-02T10:00:00.000Z');
+  const crowned = callsOf(isYearRule).find((c) => iso(c.params[1]) === '2027-01-01T00:00:00.000Z');
+  assert.deepEqual(crowned.params.map(iso), ['2026-01-01T00:00:00.000Z', '2027-01-01T00:00:00.000Z']);
+  assert.deepEqual(callsOf(isPeriodInsert).map((c) => c.params.slice(0, 2)), [['month', '2026-12-01'], ['year', '2026-01-01']]);
+  assert.equal(out.year.start, '2027-01-01');
+  assert.equal(out.year.since, '2027-01-01', 'history began before this year');
+  assert.deepEqual(out.year.last, { start: '2026-01-01', winner: { handle: 'cy', github_login: 'cy', display_name: 'CY', avatar_url: null, credits: 3100, tasks_shipped: 13 } });
+});
+
+await t('a year that ended before history began is never crowned', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  await read('2026-10-28T09:30:00.000Z');
+  assert.equal(callsOf((s) => PERIOD_PROBE.test(s)).filter((c) => c.params[0] === 'year').length, 0);
+});
+
+// ---- 5. the answer -----------------------------------------------------------------
+
+await t('the three periods, the week as builder-of-the-week.js decides it, and no github_id anywhere', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.weekShown = [{ week_start: '2026-10-19', ...row('ana', 120, 2) }];
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  engine.accounts['9'] = acct('cy');
+  const out = await read('2026-10-28T09:30:00.000Z');
+  assert.deepEqual(Object.keys(out), ['week', 'month', 'year']);
+  assert.deepEqual(out.week, { start: '2026-10-19', end: '2026-10-26', winner: { handle: 'ana', github_login: 'ana', display_name: 'ANA', avatar_url: null, credits: 120, tasks_shipped: 2 } });
+  assert.doesNotMatch(JSON.stringify(out), /github_id|"9"/);
+});
+
+// ---- 6. the route -----------------------------------------------------------------
+
+function serve() {
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildRoutes());
+  const server = app.listen(0, '127.0.0.1');
+  return new Promise((resolve) => server.once('listening', () => resolve(server)));
+}
+function get(server, path_, headers = {}) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port: server.address().port, path: path_, headers }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body, json: body ? JSON.parse(body) : null }));
+    }).on('error', reject);
+  });
+}
+
+const server = await serve();
+const URL_ = '/api/bongos/community/crowns';
+
+await t('GET /community/crowns: the three periods; no-store; CORS-open; the same for every viewer', async () => {
+  reset();
+  engine.history = HISTORY_BEGAN;
+  engine.winners.year = { github_id: '9', credits: '3000', tasks_shipped: '12' };
+  engine.accounts['9'] = acct('cy');
+  const anon = await get(server, URL_);
+  assert.equal(anon.status, 200);
+  assert.equal(anon.headers['cache-control'], 'no-store');
+  assert.equal(anon.headers['access-control-allow-origin'], '*');
+  assert.deepEqual(Object.keys(anon.json), ['week', 'month', 'year']);
+  assert.equal(anon.json.year.winner.handle, 'cy');
+  assert.doesNotMatch(anon.body, /github_id/);
+  const signedIn = await get(server, URL_, { Cookie: 'bongos_session=x', Authorization: 'Bearer y' });
+  assert.equal(signedIn.body, anon.body, 'the route reads no session');
+});
+
+await t('a failure is the 500 envelope, never a stack', async () => {
+  reset();
+  engine.throwOn = (sql) => HISTORY.test(sql);
+  const r = await get(server, URL_);
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'community_crowns_failed');
+  assert.doesNotMatch(r.body, /boom/);
+});
+
+await t('its own rate-limit budget, not the leaderboard’s or the week’s', () => {
+  const { _internals } = buildRoutes;
+  assert.equal(_internals.CROWNS_READ_RATE_SCOPE, 'community-crowns-read');
+  assert.equal(new Set([_internals.CROWNS_READ_RATE_SCOPE, _internals.READ_RATE_SCOPE, _internals.WEEK_READ_RATE_SCOPE]).size, 3);
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);