@bongos/core 1.23.18 → 1.23.20

package/modules/platform-identity/builder-of-the-week.js

@@ -53,20 +53,40 @@ function crownedWeek(now = new Date()) {
 
 const isoDate = (d) => d.toISOString().slice(0, 10);
 
-// The week's winner among eligible builders, or null. Arithmetic is bigint for the
-// leaderboard's reason: the columns are instance-reported int4.
-async function computeWinner(start, end, pool) {
-  const { rows } = await pool.query(
-    `WITH act AS (
+// The per-(project, builder) deltas over [$1, $2] among eligible builders, as the CTEs
+// `act` and `per_project`: the week's, month's and year's (computeWinner below) and the 30
+// days' (community-movers.js). Arithmetic is bigint for the leaderboard's reason: the
+// columns are instance-reported int4. `fromFirstSnapshot` is the YEAR's rule (owner,
+// 2026-10-27): a row with no snapshot before the start, and not first seen inside, counts
+// from its first snapshot inside instead of not at all, since history began in late
+// September 2026 and the rule above would leave that year to new builders alone.
+// `base_credits` is what a row had at the start by the same rule.
+function periodRowsSql({ fromFirstSnapshot = false } = {}) {
+  const base = (col) => (fromFirstSnapshot
+    ? `COALESCE(b.${col}, CASE WHEN act.first_seen_at >= $1::timestamptz THEN 0 ELSE f.${col} END, 0)`
+    : `COALESCE(b.${col}, 0)`);
+  const firstInside = fromFirstSnapshot
+    ? `
+         LEFT JOIN LATERAL (
+           SELECT s.credits, s.tasks_shipped, s.karma
+             FROM platform_identity_activity_snapshots s
+            WHERE s.client_id = act.client_id AND s.github_id = act.github_id
+              AND s.reported_at > $1::timestamptz AND s.reported_at <= $2::timestamptz
+            ORDER BY s.reported_at ASC, s.id ASC
+            LIMIT 1
+         ) f ON true`
+    : '';
+  return `WITH act AS (
        SELECT a.client_id, a.github_id, a.first_seen_at, pa.handle, pa.github_login
          FROM platform_identity_builder_project_activity a
          JOIN platform_identity_accounts pa ON pa.github_id = a.github_id
         WHERE ${rollupVisibleSql('pa')}
      ), per_project AS (
-       SELECT act.github_id, act.handle, act.github_login,
-              COALESCE(e.credits, 0)::bigint - COALESCE(b.credits, 0)             AS credits,
-              COALESCE(e.tasks_shipped, 0)::bigint - COALESCE(b.tasks_shipped, 0) AS tasks_shipped,
-              COALESCE(e.karma, 0)::bigint - COALESCE(b.karma, 0)                 AS karma
+       SELECT act.client_id, act.github_id, act.handle, act.github_login,
+              COALESCE(e.credits, 0)::bigint - ${base('credits')}             AS credits,
+              COALESCE(e.tasks_shipped, 0)::bigint - ${base('tasks_shipped')} AS tasks_shipped,
+              COALESCE(e.karma, 0)::bigint - ${base('karma')}                 AS karma,
+              ${base('credits')}::bigint                                      AS base_credits
          FROM act
          LEFT JOIN LATERAL (
            SELECT s.credits, s.tasks_shipped, s.karma
@@ -83,9 +103,15 @@ async function computeWinner(start, end, pool) {
               AND s.reported_at <= $1::timestamptz
             ORDER BY s.reported_at DESC, s.id DESC
             LIMIT 1
-         ) b ON true
-        WHERE b.credits IS NOT NULL OR act.first_seen_at >= $1::timestamptz
-     )
+         ) b ON true${firstInside}
+        WHERE b.credits IS NOT NULL OR act.first_seen_at >= $1::timestamptz${fromFirstSnapshot ? ' OR f.credits IS NOT NULL' : ''}
+     )`;
+}
+
+// The winner of [start, end) among eligible builders, or null.
+async function computeWinner(start, end, pool, { fromFirstSnapshot = false } = {}) {
+  const { rows } = await pool.query(
+    `${periodRowsSql({ fromFirstSnapshot })}
      SELECT github_id, sum(credits)::bigint AS credits, sum(tasks_shipped)::bigint AS tasks_shipped
        FROM per_project
       GROUP BY github_id, handle, github_login
@@ -98,10 +124,11 @@ async function computeWinner(start, end, pool) {
   return rows[0] || null;
 }
 
-// One crowning per week per process: concurrent first reads share it, and a week
-// already on record is not asked about again.
+// One crowning per period per process: concurrent first reads share it, and a period
+// already on record is not asked about again. Keyed 'week:', 'month:' or 'year:' plus the
+// period's first day, so community-crowns.js shares it.
 const crowning = new Map();
-let lastCrowned = null;
+const crowned = new Map(); // key → the pool it was crowned on
 
 async function crownWeek(start, end, pool) {
   const week = isoDate(start);
@@ -119,22 +146,27 @@ async function crownWeek(start, end, pool) {
   );
 }
 
-function ensureCrowned(start, end, pool) {
-  const week = isoDate(start);
-  if (lastCrowned && lastCrowned.week === week && lastCrowned.pool === pool) return Promise.resolve();
-  const inFlight = crowning.get(week);
+// Runs `crown()` unless `key` is already crowned on this pool; a failed one is not
+// remembered, so the next read tries again.
+function crownOnce(key, pool, crown) {
+  if (crowned.get(key) === pool) return Promise.resolve();
+  const inFlight = crowning.get(key);
   if (inFlight && inFlight.pool === pool) return inFlight.promise;
   const entry = { pool };
-  entry.promise = crownWeek(start, end, pool)
-    .then(() => { lastCrowned = { week, pool }; })
-    .finally(() => { if (crowning.get(week) === entry) crowning.delete(week); });
-  crowning.set(week, entry);
+  entry.promise = crown()
+    .then(() => { crowned.set(key, pool); })
+    .finally(() => { if (crowning.get(key) === entry) crowning.delete(key); });
+  crowning.set(key, entry);
   return entry.promise;
 }
 
+function ensureCrowned(start, end, pool) {
+  return crownOnce(`week:${isoDate(start)}`, pool, () => crownWeek(start, end, pool));
+}
+
 function clearCrownMemo() {
   crowning.clear();
-  lastCrowned = null;
+  crowned.clear();
 }
 
 // readBuilderOfTheWeek — crowns the last full week if nobody has yet, then reads it and
@@ -177,4 +209,9 @@ module.exports = {
   crownedWeek,
   clearCrownMemo,
   ARCHIVE_WEEKS,
+  // for community-crowns.js (the month and the year) and community-movers.js (the 30 days)
+  computeWinner,
+  periodRowsSql,
+  crownOnce,
+  isoDate,
 };

package/modules/platform-identity/community-crowns.js

@@ -0,0 +1,176 @@
+// modules/platform-identity/community-crowns.js — the builders of the week, the month and
+// the year, the read behind GET /community/crowns for the hub's /community page (task
+// 1004902, goal 1000110). The week is builder-of-the-week.js's; this file adds the other two
+// and answers all three at once.
+//
+// THE RULE is the week's (owner, 2026-10-27): of the builders the leaderboard may show
+// (rollupVisibleSql), the most credits across every project in the period among those who
+// shipped at least one work in it; ties to works, then karma, then handle/login. Read from
+// the snapshot history through builder-of-the-week.js computeWinner, never the live rows.
+//
+// THE MONTH is the last full calendar month (UTC), crowned at the first read on or after
+// the 1st and pinned in platform_identity_period_features (migration 033), exactly as the
+// week is: ON CONFLICT DO NOTHING, never updated, an empty month recorded too. A month that
+// began before snapshot history did is not crowned at all (it would be "nobody" for want of
+// data, not of work); the answer names the day the first month will be.
+//
+// THE YEAR is live: the leader from 1 January (UTC) to now, recomputed at most every 30s. History
+// began in late September 2026, so the year counts a row with no snapshot before 1 January
+// from its first snapshot inside it (computeWinner's fromFirstSnapshot), and `since` says
+// when history began while that is inside the year. The first read on or after 1 January
+// crowns the year that ended, by the same rule, and `last` shows it.
+//
+// WHO IS SHOWN is decided again on every read, as for the week: a pinned winner who has
+// since hidden or gone private is drawn nowhere and their period goes to nobody else (spec
+// D8). Viewer-independent; github_id never crosses the projection.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { rollupVisibleSql } = require('./account-visibility');
+const { readBuilderOfTheWeek, computeWinner, crownOnce, isoDate } = require('./builder-of-the-week');
+
+const monthStart = (y, m) => new Date(Date.UTC(y, m, 1));
+
+// The month the crown covers at `now`: the last full month before `now`'s own.
+function crownedMonth(now = new Date()) {
+  const end = monthStart(now.getUTCFullYear(), now.getUTCMonth());
+  return { start: monthStart(now.getUTCFullYear(), now.getUTCMonth() - 1), end };
+}
+
+// The first month that began at or after `history`: the first one there is data for.
+function firstFullMonth(history) {
+  const m = monthStart(history.getUTCFullYear(), history.getUTCMonth());
+  return m.getTime() === history.getTime() ? m : monthStart(history.getUTCFullYear(), history.getUTCMonth() + 1);
+}
+
+// When snapshot history began: the first snapshot ever written (its primary key, so one
+// index probe). Never changes once there is one, so it is remembered per pool.
+const historyMemo = new Map();
+async function historyStart(pool) {
+  if (historyMemo.has(pool)) return historyMemo.get(pool);
+  const { rows } = await pool.query(
+    'SELECT reported_at FROM platform_identity_activity_snapshots ORDER BY id ASC LIMIT 1',
+  );
+  const at = rows[0] ? new Date(rows[0].reported_at) : null;
+  if (at) historyMemo.set(pool, at);
+  return at;
+}
+
+async function crownPeriod(period, start, end, pool, opts) {
+  const day = isoDate(start);
+  const { rows } = await pool.query(
+    'SELECT 1 FROM platform_identity_period_features WHERE period = $1 AND period_start = $2::date',
+    [period, day],
+  );
+  if (rows.length) return;
+  const winner = await computeWinner(start, end, pool, opts);
+  await pool.query(
+    `INSERT INTO platform_identity_period_features (period, period_start, github_id, credits_delta, ships_delta)
+     VALUES ($1, $2::date, $3::bigint, $4::bigint, $5::bigint)
+     ON CONFLICT (period, period_start) DO NOTHING`,
+    [period, day, winner ? winner.github_id : null, winner ? winner.credits : 0, winner ? winner.tasks_shipped : 0],
+  );
+}
+
+const shown = (r, credits, ships) => ({
+  handle: r.handle,
+  github_login: r.github_login,
+  display_name: r.display_name,
+  avatar_url: r.avatar_url,
+  credits: Number(credits),
+  tasks_shipped: Number(ships),
+});
+
+// A crowned period's winner, if they may still be shown.
+async function readCrowned(period, start, pool) {
+  const { rows } = await pool.query(
+    `SELECT f.credits_delta, f.ships_delta, pa.handle, pa.github_login, pa.display_name, pa.avatar_url
+       FROM platform_identity_period_features f
+       JOIN platform_identity_accounts pa ON pa.github_id = f.github_id
+      WHERE f.period = $1 AND f.period_start = $2::date
+        AND ${rollupVisibleSql('pa')}`,
+    [period, isoDate(start)],
+  );
+  return rows[0] ? shown(rows[0], rows[0].credits_delta, rows[0].ships_delta) : null;
+}
+
+async function readMonth(now, history, pool) {
+  const { start, end } = crownedMonth(now);
+  const out = { start: isoDate(start), end: isoDate(end), winner: null, first_crown: null };
+  if (!history) return out;
+  if (start < history) {
+    const first = firstFullMonth(history);
+    out.first_crown = isoDate(monthStart(first.getUTCFullYear(), first.getUTCMonth() + 1));
+    return out;
+  }
+  await crownOnce(`month:${out.start}`, pool, () => crownPeriod('month', start, end, pool));
+  out.winner = await readCrowned('month', start, pool);
+  return out;
+}
+
+// The year so far is the one answer computed on a read rather than pinned, so its leader is
+// memoised per pool for LEADER_TTL_MS, as the leaderboard memoises its totals; whether that
+// leader may be shown is still asked on every read, so a hide beats the memo.
+const LEADER_TTL_MS = 30 * 1000;
+const leaderMemo = new Map(); // pool → { start, at, leader }
+async function yearLeader(start, now, pool) {
+  const m = leaderMemo.get(pool);
+  const at = now.getTime();
+  if (m && m.start === isoDate(start) && at >= m.at && at - m.at < LEADER_TTL_MS) return m.leader;
+  const leader = await computeWinner(start, now, pool, { fromFirstSnapshot: true });
+  leaderMemo.set(pool, { start: isoDate(start), at, leader });
+  return leader;
+}
+
+async function readYear(now, history, pool) {
+  const start = monthStart(now.getUTCFullYear(), 0);
+  const out = { start: isoDate(start), since: isoDate(history && history > start ? history : start), winner: null, last: null };
+  if (!history) return out;
+  const leader = await yearLeader(start, now, pool);
+  if (leader) {
+    const { rows } = await pool.query(
+      `SELECT pa.handle, pa.github_login, pa.display_name, pa.avatar_url
+         FROM platform_identity_accounts pa
+        WHERE pa.github_id = $1::bigint AND ${rollupVisibleSql('pa')}`,
+      [leader.github_id],
+    );
+    if (rows[0]) out.winner = shown(rows[0], leader.credits, leader.tasks_shipped);
+  }
+  if (history < start) {
+    const prev = monthStart(now.getUTCFullYear() - 1, 0);
+    await crownOnce(`year:${isoDate(prev)}`, pool, () => crownPeriod('year', prev, start, pool, { fromFirstSnapshot: true }));
+    const winner = await readCrowned('year', prev, pool);
+    if (winner) out.last = { start: isoDate(prev), winner };
+  }
+  return out;
+}
+
+// readCrowns — { week: { start, end, winner }, month: { start, end, winner, first_crown },
+// year: { start, since, winner, last } }: dates YYYY-MM-DD, an end the day the period
+// closed on, a winner null when nobody is to be shown. `now` is injectable for tests.
+async function readCrowns({ now = new Date(), pool = defaultPool } = {}) {
+  const history = historyStart(pool);
+  const [week, month, year] = await Promise.all([
+    readBuilderOfTheWeek({ now, pool }),
+    history.then((h) => readMonth(now, h, pool)),
+    history.then((h) => readYear(now, h, pool)),
+  ]);
+  const w = week.winner;
+  return {
+    week: { start: week.week.start, end: week.week.end, winner: w ? shown(w, w.credits, w.tasks_shipped) : null },
+    month,
+    year,
+  };
+}
+
+function clearCrownsMemo() {
+  historyMemo.clear();
+  leaderMemo.clear();
+}
+
+module.exports = {
+  readCrowns,
+  crownedMonth,
+  clearCrownsMemo,
+  LEADER_TTL_MS,
+};

package/modules/platform-identity/community-leaderboard.js

@@ -2,7 +2,7 @@
 // leaderboard (D3, docs/specs/bongos-v1-community-tab.md; task 1002978, goal
 // 1000110 CT2): "who earned the most across every project, this week / month /
 // year / ever", optionally narrowed to one discipline. The read behind
-// GET /community/leaderboard, for the hub's /community page (task 1003363).
+// GET /community/leaderboard, for the hub's /community/leaderboard page (tasks 1003363, 1004902).
 //
 // WHO: rollupVisibleSql — active + public + NOT hide_stats, the privacy matrix's
 // NUMBERS predicate, imported from account-visibility.js and never restated. A
@@ -231,4 +231,7 @@ module.exports = {
   MAX_LIMIT,
   MAX_OFFSET,
   MAX_DISCIPLINE_CHARS,
+  // for community-movers.js (the rising builder), so who is shown and the tie order are one rule
+  eligibleIdentities,
+  compareRows,
 };

package/modules/platform-identity/community-movers.js

@@ -0,0 +1,152 @@
+// modules/platform-identity/community-movers.js — the rising builder and the projects on the
+// move, the read behind GET /community/movers for the row under the crowns on the hub's
+// /community home (community spec D7 items 1–2; task 1002983, goal 1000110 CT7).
+//
+// THE 30 DAYS are rolling, up to now, and read from the snapshot history by the year's
+// baseline rule (builder-of-the-week.js periodRowsSql, fromFirstSnapshot): a row first seen
+// inside counts from zero, a row with no snapshot before them from its first one inside (an
+// undercount, never a lifetime).
+//
+// THE RISING BUILDER (owner, 2026-10-28): the most credits earned in the 30 days among the
+// builders who had under RISING_BASE_MAX before them, with at least one work shipped in
+// them; ties as the crowns. "Before" is each row's baseline, and a row with no history in
+// the 30 days at all counts its live total, so a veteran's quiet projects still count.
+//
+// THE PROJECTS ON THE MOVE (owner, 2026-10-28): the most works shipped in the 30 days, then
+// credits, the top PROJECTS_MAX. Only the builders the leaderboard may show are counted
+// (spec D8), and a project is named only where a profile may name it: on the map with the
+// Public door (task 1003558); private and stealth projects are left off, not anonymised.
+//
+// TWO HALVES, as the leaderboard: the 30 days' rows (one snapshot probe per activity row)
+// are memoised per pool for MOVERS_TTL_MS; who and which projects may be shown is asked on
+// every read, so a hide, a private account or a closed door beats the memo. Viewer-
+// independent; github_id and client_id never cross the projection.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { periodRowsSql } = require('./builder-of-the-week');
+const { eligibleIdentities, compareRows, windowStart } = require('./community-leaderboard');
+const { onMapSql } = require('./projects-feed');
+
+const WINDOW = '30d';
+const RISING_BASE_MAX = 100;
+const PROJECTS_MAX = 5;
+const MOVERS_TTL_MS = 30 * 1000;
+
+// Every eligible (project, builder) row's 30 days: [{ clientId, githubId, credits,
+// tasks_shipped, karma, base }]. A row the period rule leaves out moved nowhere in them, so
+// its deltas are zero and its baseline is its live total.
+async function computeRows(start, end, pool) {
+  const { rows } = await pool.query(
+    `${periodRowsSql({ fromFirstSnapshot: true })}
+     SELECT a.client_id, a.github_id, pp.credits, pp.tasks_shipped, pp.karma,
+            COALESCE(pp.base_credits, a.credits::bigint) AS base_credits
+       FROM act
+       JOIN platform_identity_builder_project_activity a
+         ON a.client_id = act.client_id AND a.github_id = act.github_id
+       LEFT JOIN per_project pp
+         ON pp.client_id = act.client_id AND pp.github_id = act.github_id`,
+    [start, end],
+  );
+  return rows.map((r) => ({
+    clientId: String(r.client_id),
+    githubId: String(r.github_id),
+    credits: Number(r.credits || 0),
+    tasks_shipped: Number(r.tasks_shipped || 0),
+    karma: Number(r.karma || 0),
+    base: Number(r.base_credits || 0),
+  }));
+}
+
+// pool → { at, start, end, promise }. Concurrent reads share one in-flight computation; a
+// failed one is dropped so the next read retries.
+const rowsMemo = new Map();
+function windowRows(now, pool) {
+  const m = rowsMemo.get(pool);
+  const at = now.getTime();
+  if (m && at >= m.at && at - m.at < MOVERS_TTL_MS) return m;
+  const start = windowStart(WINDOW, now);
+  const entry = { at, start, end: now, promise: computeRows(start, now, pool) };
+  entry.promise.catch(() => { if (rowsMemo.get(pool) === entry) rowsMemo.delete(pool); });
+  rowsMemo.set(pool, entry);
+  return entry;
+}
+
+// The projects among `clientIds` a profile may name, now: Map clientId → { name, origin }.
+async function namedProjects(clientIds, pool) {
+  if (clientIds.length === 0) return new Map();
+  const { rows } = await pool.query(
+    `SELECT c.client_id, p.name, p.origin
+       FROM platform_identity_sso_clients c
+       JOIN platform_identity_projects p ON p.origin = c.origin
+      WHERE c.client_id = ANY($1::text[])
+        AND ${onMapSql('p')} AND p.visibility = 'public'`,
+    [clientIds],
+  );
+  return new Map(rows.map((r) => [String(r.client_id), { name: r.name, origin: r.origin }]));
+}
+
+// Sums `rows` per `key`, from zero.
+function sumBy(rows, key) {
+  const out = new Map();
+  for (const r of rows) {
+    const k = r[key];
+    const s = out.get(k) || { credits: 0, tasks_shipped: 0, karma: 0, base: 0 };
+    s.credits += r.credits;
+    s.tasks_shipped += r.tasks_shipped;
+    s.karma += r.karma;
+    s.base += r.base;
+    out.set(k, s);
+  }
+  return out;
+}
+
+function risingBuilder(rows, identities) {
+  const ranked = [...sumBy(rows, 'githubId')]
+    .filter(([, s]) => s.base < RISING_BASE_MAX && s.tasks_shipped >= 1)
+    .map(([id, s]) => ({ ...identities.get(id), credits: s.credits, tasks_shipped: s.tasks_shipped, karma: s.karma }))
+    .sort(compareRows);
+  if (!ranked.length) return null;
+  const { handle, github_login, display_name, avatar_url, credits, tasks_shipped } = ranked[0];
+  return { handle, github_login, display_name, avatar_url, credits, tasks_shipped };
+}
+
+const byText = (x, y) => (x < y ? -1 : x > y ? 1 : 0);
+function projectsOnTheMove(rows, named) {
+  return [...sumBy(rows.filter((r) => named.has(r.clientId)), 'clientId')]
+    .filter(([, s]) => s.tasks_shipped >= 1)
+    .map(([id, s]) => ({ ...named.get(id), tasks_shipped: s.tasks_shipped, credits: s.credits }))
+    .sort((a, b) => (b.tasks_shipped - a.tasks_shipped) || (b.credits - a.credits)
+      || byText(String(a.name), String(b.name)) || byText(String(a.origin), String(b.origin)))
+    .slice(0, PROJECTS_MAX);
+}
+
+// readMovers — { window: { start, end }, rising, projects }: the window as ISO instants,
+// rising null when nobody qualifies or may be shown, projects best first (at most
+// PROJECTS_MAX). `now` is injectable for tests.
+async function readMovers({ now = new Date(), pool = defaultPool } = {}) {
+  const w = windowRows(now, pool);
+  const rows = await w.promise;
+  // Only a builder or project with a shipped work in the 30 days can be on either card.
+  const shipped = rows.filter((r) => r.tasks_shipped > 0);
+  const identities = await eligibleIdentities([...new Set(shipped.map((r) => r.githubId))], pool);
+  const shown = rows.filter((r) => identities.has(r.githubId));
+  const named = await namedProjects([...new Set(shown.filter((r) => r.tasks_shipped > 0).map((r) => r.clientId))], pool);
+  return {
+    window: { start: w.start.toISOString(), end: w.end.toISOString() },
+    rising: risingBuilder(shown, identities),
+    projects: projectsOnTheMove(shown, named),
+  };
+}
+
+function clearMoversMemo() {
+  rowsMemo.clear();
+}
+
+module.exports = {
+  readMovers,
+  clearMoversMemo,
+  RISING_BASE_MAX,
+  PROJECTS_MAX,
+  MOVERS_TTL_MS,
+};

package/modules/platform-identity/migrations/platform_identity_033_period_features.sql

@@ -0,0 +1,43 @@
+-- platform_identity_033_period_features.sql — Builder of the month and of the year, one
+-- row per crowned month or year (task 1004902; the week is migration 032's own table).
+--
+-- WHY. The hub's /community page shows a builder of the week, of the month and of the
+-- year (owner, 2026-10-27). The month is decided like the week: the first read of
+-- GET /community/crowns after the 1st (UTC) decides the month that just ended and writes
+-- it here. The year is shown live as "so far", and the first read on or after 1 January
+-- decides the year that just ended and writes it here. The row is what pins the crown:
+-- a late report or a builder going public cannot take a period already decided.
+--
+-- THE SHAPE CARRIES THE RULES (owner, 2026-10-27):
+--   * THE KEY IS (period, period_start), the first day (UTC) of the month or year, so a
+--     period has one row. The writer is INSERT ... ON CONFLICT DO NOTHING, and nothing
+--     updates a row: the first decision stands.
+--   * github_id IS NULL when nobody qualified. The empty period is recorded too, so it
+--     stays empty.
+--   * credits_delta / ships_delta are the period's numbers as decided, bigint like the
+--     leaderboard's arithmetic (builder-of-the-week.js computeWinner).
+--   * NO FOREIGN KEY to platform_identity_accounts, like every github_id column in this
+--     module. Whether a winner may be SHOWN is decided at read time by rollupVisibleSql
+--     (account-visibility.js), never by this row.
+--
+-- NOTHING HERE IS AUTHORITY (ADR 0016 / ADR 0141): descriptive, public analytics.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). A CREATE only, so the previous
+-- release still runs against this schema. Idempotent.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_period_features (
+  period        text NOT NULL CHECK (period IN ('month', 'year')),
+  period_start  date NOT NULL,
+  github_id     bigint,
+  credits_delta bigint NOT NULL,
+  ships_delta   bigint NOT NULL,
+  crowned_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (period, period_start)
+);
+
+COMMENT ON TABLE platform_identity_period_features IS
+  'Builder of the month and of the year, one row per period, keyed on its first day (UTC) (task 1004902). Written once by the first read after the period ends, never updated; github_id NULL = nobody qualified. Whether a winner is shown is decided at read time by the leaderboard''s eligibility predicate.';
+
+COMMIT;

package/modules/platform-identity/routes/community-leaderboard.js

@@ -1,13 +1,16 @@
 // modules/platform-identity/routes/community-leaderboard.js — GET
 // /community/leaderboard, the PUBLIC windowed leaderboard behind the hub's
-// /community page (D3, docs/specs/bongos-v1-community-tab.md; task 1002978,
+// /community/leaderboard page (D3, docs/specs/bongos-v1-community-tab.md; task 1002978,
 // goal 1000110 CT2). The sibling of routes/community-search.js: same module,
 // same public posture. Who appears and how a window is counted live entirely in
 // ../community-leaderboard.js; this file is the HTTP shell — validation, the
 // per-IP read cap, the response envelope. It never reads a session, so the
 // board is the same for every viewer.
 // It also serves GET /community/builder-of-the-week (spec D5, task 1002981), the
-// board's weekly crown, from ../builder-of-the-week.js on the same terms.
+// board's weekly crown, from ../builder-of-the-week.js on the same terms, and GET
+// /community/crowns (task 1004902), the week, month and year for the hub's /community
+// page, from ../community-crowns.js, and GET /community/movers (task 1002983), the rising
+// builder and the projects on the move under them, from ../community-movers.js.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -16,6 +19,8 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const leaderboard = require('../community-leaderboard');
 const builderOfTheWeek = require('../builder-of-the-week');
+const communityCrowns = require('../community-crowns');
+const communityMovers = require('../community-movers');
 const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, corsPublicGet } = api;
@@ -26,6 +31,10 @@ const leaderboardReadRateLimit = createReadRateLimit({ scope: READ_RATE_SCOPE, l
 // Builder of the Week spends its own budget (ADR 0209: never a shared one).
 const WEEK_READ_RATE_SCOPE = 'builder-of-the-week-read';
 const weekReadRateLimit = createReadRateLimit({ scope: WEEK_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
+const CROWNS_READ_RATE_SCOPE = 'community-crowns-read';
+const crownsReadRateLimit = createReadRateLimit({ scope: CROWNS_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
+const MOVERS_READ_RATE_SCOPE = 'community-movers-read';
+const moversReadRateLimit = createReadRateLimit({ scope: MOVERS_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
 
 module.exports = function communityLeaderboardRoutes() {
   const router = express.Router();
@@ -87,7 +96,40 @@ module.exports = function communityLeaderboardRoutes() {
     }
   });
 
+  router.use('/community/crowns', corsPublicGet('/community/crowns'));
+
+  // rank: public — the builders of the week, the month and the year (task 1004902): the
+  // week and month as crowned, the year so far. Takes no parameters; the first read after
+  // a week, month or year ends also records it (one row per period). Viewer-independent;
+  // no-store so a winner who hides leaves the page on the next read (ADR 0171 D5).
+  router.get('/community/crowns', crownsReadRateLimit, async (req, res) => {
+    try {
+      const out = await communityCrowns.readCrowns({ pool });
+      res.set('Cache-Control', 'no-store');
+      res.json(out);
+    } catch (err) {
+      api.logger('platform-identity').error({ err: err && err.message }, 'GET /community/crowns failed');
+      res.fail('community_crowns_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  router.use('/community/movers', corsPublicGet('/community/movers'));
+
+  // rank: public — the rising builder and the projects on the move, the last 30 days (task
+  // 1002983). Takes no parameters and writes nothing. Viewer-independent; no-store so a
+  // builder who hides leaves it on the next read (ADR 0171 D5).
+  router.get('/community/movers', moversReadRateLimit, async (req, res) => {
+    try {
+      const out = await communityMovers.readMovers({ pool });
+      res.set('Cache-Control', 'no-store');
+      res.json(out);
+    } catch (err) {
+      api.logger('platform-identity').error({ err: err && err.message }, 'GET /community/movers failed');
+      res.fail('community_movers_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 
-module.exports._internals = { READ_RATE_LIMIT, READ_RATE_SCOPE, WEEK_READ_RATE_SCOPE };
+module.exports._internals = { READ_RATE_LIMIT, READ_RATE_SCOPE, WEEK_READ_RATE_SCOPE, CROWNS_READ_RATE_SCOPE, MOVERS_READ_RATE_SCOPE };

package/modules/public-landing/public/account.html

@@ -117,7 +117,8 @@
 <div class="menuBand" id="menuCommunity" data-menu="community" hidden>
   <div class="bandIn">
     <ul class="bandRow">
-      <li class="bandCell"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
+      <li class="bandCell"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li>
+      <li class="bandCell"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li>
       <li class="bandCell"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li>
       <li class="bandCell"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li>
       <li class="bandCell"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li>
@@ -132,7 +133,7 @@
       <li class="bandCell"><a class="bandT" href="/projects?view=map&amp;sub=table">Table</a><span class="bandC">the same projects as rows</span></li>
       <li class="bandCell" id="mineCell"><a class="bandT" href="/projects?view=mine">Your projects</a><span class="bandC">the ones you own</span></li>
       <li class="bandCell"><a class="bandT" href="/projects?view=new">New project</a><span class="bandC">five questions and a home</span></li>
-      <li class="bandCell bandFold"><a class="bandT" href="/community">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>
+      <li class="bandCell bandFold"><a class="bandT" href="/community">Community home</a><span class="bandC">the builders of the week, month and year</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/leaderboard">Leaderboard</a><span class="bandC">who earned the most, across every project</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/week">Builder of the week</a><span class="bandC">the top earner of each week, and how it is chosen</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/find">Find a builder</a><span class="bandC">anyone building here, by name or role</span></li><li class="bandCell bandFold"><a class="bandT" href="/community/recruiters">Open to recruiters</a><span class="bandC">who is open to recruiting, for project owners</span></li><li class="bandCell bandFold knowCell" hidden><a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>
     </ul>
   </div>
 </div>

package/modules/public-landing/public/community-crowns-first.states.json

@@ -0,0 +1,15 @@
+{
+  "_": "The community home before the first month is crowned (task 1004902; fixtures/community-crowns-first.json): what the hub shows in late October 2026. September began before snapshot history did, so the month card names the day October is crowned; the year counts since history began.",
+  "page": "/community",
+  "surface": "public-landing",
+  "modes": ["dark"],
+  "modeQuery": false,
+  "stub": { "fixtures": { "community-crowns": "community-crowns-first" } },
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/me/guild-", "/scouting$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "/scouting", "\\b40[13]\\b", "Unauthorized", "Forbidden"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "out-home-first": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#home", "#homeCrowns", "#crownWeek .crownName", "#crownMonth .commMsg", "#crownYear .crownName"], "hidden": ["#homeFailed", "#crownYearLast"], "text": [["#crownWeekWhen", "19–25 Oct 2026"], ["#crownMonthWhen", "September 2026"], ["#crownMonth .commMsg", "The first builder of the month is named on 1 Nov 2026."], ["#crownYearWhen", "2026 so far, since 27 Sep 2026"], ["#crownYear .crownName", "Priya Nair"]] } }
+  },
+  "reducedMotion": { "auth": false, "actions": [["wait", 400]] }
+}