@bongos/core 1.23.19 → 1.23.20

package/modules/public-landing/public/community-movers-none.states.json

@@ -0,0 +1,15 @@
+{
+  "_": "The community home with no movers to show (task 1002983; fixtures/community-movers-none.json): the row under the crowns stands with one line in each card.",
+  "page": "/community",
+  "surface": "public-landing",
+  "modes": ["dark"],
+  "modeQuery": false,
+  "stub": { "fixtures": { "community-movers": "community-movers-none" } },
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/me/guild-", "/scouting$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "/scouting", "\\b40[13]\\b", "Unauthorized", "Forbidden"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "out-home-movers-none": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#homeMovers", "#moveRising .commMsg", "#moveNone", "#moversRule"], "count": [["#moveProjects .commRow", 0]], "text": [["#moveRising .commMsg", "No rising builder in the last 30 days."], ["#moveNone", "No public project shipped a work in the last 30 days."]] } }
+  },
+  "reducedMotion": { "auth": false, "actions": [["wait", 400]] }
+}

package/modules/public-landing/public/community.html

@@ -7,15 +7,17 @@
      spec docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8). Who is building, across every
      project, as five sub-pages of the bar's Community menu (owner, 2026-10-27), all served
      from this one file: /community is the community home (task 1004902: the builders of the
-     week, month and year, and a door to each page), /community/leaderboard the leaderboard,
+     week, month and year, under them the rising builder and the projects on the move (task
+     1002983), and a door to each page), /community/leaderboard the leaderboard,
      /community/week the builder of the week (task 1002981, spec D5), /community/find the
      builder search, /community/recruiters the builders who hide their numbers but are open
      to recruiters.
      The script shows the section the path names and marks it current in the menu.
      VIEWING IS UNGATED (ADR 0217 D1): the home, the leaderboard, the builder of the week and
-     the search are the same for every viewer, signed in or not. All four reads are public,
+     the search are the same for every viewer, signed in or not. All five reads are public,
      viewer-independent routes (modules/platform-identity/routes/community-leaderboard.js,
-     which also serves the builder of the week and the crowns, and community-search.js),
+     which also serves the builder of the week, the crowns and the movers, and
+     community-search.js),
      which decide WHO appears through account-visibility.js; these pages add no rule of
      their own. The one viewer-relative page is the recruiter list: drawn only from a 200 of
      GET /scouting, whose door (a project owner, or project.curate) is the server's, never
@@ -126,8 +128,18 @@
 .homeLast strong{font-weight:500;color:var(--ink);}
 .homeDoors{list-style:none;display:flex;flex-wrap:wrap;gap:10px 12px;margin:10px 0 0;padding:0;}
 .homeDoors .btn{text-transform:none;}
+/* the row under the crowns (task 1002983): the rising builder in the first column, the
+   projects on the move across the other two as board rows with no face */
+.homeMovers{margin-top:14px;}
+.homeMovers .homeWide{grid-column:span 2;align-items:stretch;}
+.moveRows{margin:0;}
+.moveRows .commRow{grid-template-columns:3ch minmax(0,1fr) auto;padding:10px 0;}
+.moveRows a{display:inline-block;min-height:24px;padding:3px 0;line-height:18px;color:var(--ink);
+  text-decoration:underline;text-decoration-color:var(--accent);text-underline-offset:4px;}
+.moveRows a:focus-visible{outline:2px solid var(--focus);outline-offset:3px;}
 @media (max-width:760px){
   .homeCrowns{grid-template-columns:minmax(0,1fr);}
+  .homeMovers .homeWide{grid-column:auto;}
 }
 @media (max-width:480px){
   .commCrown{grid-template-columns:minmax(0,1fr);}
@@ -226,6 +238,14 @@
         <li class="homeCard"><h3 class="commSub">Builder of the year</h3><p class="crownWhen" id="crownYearWhen"></p><div class="homeBody" id="crownYear"></div><p class="homeLast" id="crownYearLast" hidden></p></li>
       </ul>
       <p class="commNote" id="homeRule">Each is the builder who earned the most {{currency}} across every project in that time, among the builders who shipped at least one work in it. A tie goes to whoever shipped more works, then to whoever earned more karma. Builders who hide their numbers or keep their account private are not counted. The week and the month are decided once, when they end; the year shows the leader so far, and is decided on 1 January.</p>
+      <!-- THE ROW UNDER THE CROWNS (task 1002983; owner, 2026-10-28): the rising builder and
+           the projects on the move, the last 30 days, from GET /community/movers
+           (community-movers.js decides both). Its own read: a failed one drops only this row. -->
+      <ul class="homeCrowns homeMovers" id="homeMovers" hidden>
+        <li class="homeCard"><h3 class="commSub">Rising builder</h3><p class="crownWhen">The last 30 days</p><div class="homeBody" id="moveRising"></div></li>
+        <li class="homeCard homeWide"><h3 class="commSub">Projects on the move</h3><p class="crownWhen">The last 30 days</p><ol class="commRows moveRows" id="moveProjects"></ol><p class="commMsg" id="moveNone" hidden>No public project shipped a work in the last 30 days.</p></li>
+      </ul>
+      <p class="commNote" id="moversRule" hidden>The rising builder is the one who earned the most {{currency}} in the last 30 days, among the builders who had earned under 100 {{currency}} before them and shipped at least one work in them. Projects on the move are the public projects that shipped the most works in the last 30 days, then earned the most {{currency}}. Builders who hide their numbers or keep their account private are not counted in either.</p>
       <h3 class="commSub" id="doorsH">Community pages</h3>
       <ul class="homeDoors" aria-labelledby="doorsH">
         <li><a class="btn ghost" href="/community/leaderboard">Leaderboard</a></li>
@@ -677,6 +697,44 @@
     });
   }
 
+  // ── the row under the crowns: the rising builder and the projects on the move ──
+  // (task 1002983) community-movers.js decides both; a failed read leaves the row down.
+  function moveRow(p, i) {
+    var li = el('li', 'commRow');
+    li.appendChild(el('span', 'commPlace', String(i + 1)));
+    var main = el('div', 'mineRow__main');
+    var name = String(p.name || 'A project');
+    var href = safeHttpUrl(p.origin);
+    if (href) {
+      var a = el('a', 'mineRow__name', name);
+      a.setAttribute('href', href);
+      main.appendChild(a);
+    } else main.appendChild(el('div', 'mineRow__name', name));
+    main.appendChild(el('p', 'mineRow__hint', num(p.credits).toLocaleString() + ' ' + UNIT + ' earned'));
+    li.appendChild(main);
+    var works = el('div', 'commCredits');
+    var n = num(p.tasks_shipped);
+    works.appendChild(el('span', 'commNum', String(n)));
+    works.appendChild(el('span', 'commUnit', n === 1 ? 'work shipped' : 'works shipped'));
+    li.appendChild(works);
+    return li;
+  }
+  function loadMovers() {
+    return read('/community/movers').then(function (r) {
+      if (!r.ok) return;
+      var box = $('moveRising');
+      box.textContent = '';
+      if (r.data.rising) fillCrown(box, r.data.rising);
+      else box.appendChild(el('p', 'commMsg', 'No rising builder in the last 30 days.'));
+      var list = $('moveProjects');
+      list.textContent = '';
+      arr(r.data.projects).forEach(function (p, i) { if (p) list.appendChild(moveRow(p, i)); });
+      $('moveNone').hidden = list.children.length > 0;
+      $('homeMovers').hidden = false;
+      $('moversRule').hidden = false;
+    });
+  }
+
   // ── the search ──────────────────────────────────────────────────────────────
   function say(text, kind) {
     var s = $('findStatus');
@@ -806,7 +864,7 @@
   if (view.title) document.title = document.title + ' · ' + view.title;
   $('signinTop').setAttribute('href', '/api/bongos/auth/web/start?return=' + view.path + '&repos=1');
   if (VIEW === 'leaderboard') { loadBoard(); read('/community/builder-of-the-week').then(crownLine); }
-  if (VIEW === 'home') loadHome();
+  if (VIEW === 'home') { loadHome(); loadMovers(); }
   else if (VIEW === 'week') loadWeek();
   else if (VIEW === 'recruiters') bar.ready.then(function (me) { if (me) loadRecruit(); else showRecruit('recruitDoor'); });
   else bar.ready.then(function (me) { if (me) loadOwned(me, $(VIEW === 'find' ? 'findFor' : 'boardFor')); });

package/modules/public-landing/public/community.states.json

@@ -8,7 +8,7 @@
   "ignoreConsole": ["/api/(gds|bongos)/me", "/scouting", "\\b40[13]\\b", "Unauthorized", "Forbidden"],
   "ignoreControls": [".vh"],
   "states": {
-    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#home", "#homeCrowns", "#crownWeek .crownName", "#crownMonth .crownName", "#crownYear .crownName", "#homeRule", "#signinTop"], "hidden": ["#board", "#week", "#find", "#recruit", "#who", "#homeLoading", "#homeFailed", "#crownYearLast", ".homeDoors .knowCell"], "count": [[".homeDoors li:not([hidden])", 4]], "href": [[".homeDoors li:first-child a", "/community/leaderboard"]], "attr": [["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community\"]", "aria-current", "page"]], "text": [["#crownWeekWhen", "26 Oct – 1 Nov 2026"], ["#crownWeek .crownName", "Ada Okafor"], ["#crownMonthWhen", "October 2026"], ["#crownMonth .crownName", "Priya Nair"], ["#crownMonth .crownNums div:first-child .commNum", "6,120"], ["#crownYearWhen", "2026 so far, since 27 Sep 2026"], ["#crownYear .crownName", "Maximiliana van der Berghe-Lindqvist"]] } },
+    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#home", "#homeCrowns", "#crownWeek .crownName", "#crownMonth .crownName", "#crownYear .crownName", "#homeRule", "#signinTop", "#homeMovers", "#moveRising .crownName", "#moversRule"], "hidden": ["#board", "#week", "#find", "#recruit", "#who", "#homeLoading", "#homeFailed", "#crownYearLast", ".homeDoors .knowCell", "#moveNone"], "count": [[".homeDoors li:not([hidden])", 4], ["#moveProjects .commRow", 5]], "href": [[".homeDoors li:first-child a", "/community/leaderboard"], ["#moveProjects .commRow:first-child a", "https://tidepool.example/"]], "attr": [["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community\"]", "aria-current", "page"]], "text": [["#crownWeekWhen", "26 Oct – 1 Nov 2026"], ["#crownWeek .crownName", "Ada Okafor"], ["#crownMonthWhen", "October 2026"], ["#crownMonth .crownName", "Priya Nair"], ["#crownMonth .crownNums div:first-child .commNum", "6,120"], ["#crownYearWhen", "2026 so far, since 27 Sep 2026"], ["#crownYear .crownName", "Maximiliana van der Berghe-Lindqvist"], ["#moveRising .crownName", "Kofi Mensah"], ["#moveProjects .commRow:first-child .commNum", "23"], ["#moveProjects .commRow:first-child .mineRow__hint", "1,840 credits earned"]] } },
     "in": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#home", "#homeCrowns", "#who", ".homeDoors .knowCell"], "hidden": ["#board", "#signinTop", "#homeFailed"], "count": [[".homeDoors li:not([hidden])", 5]], "href": [[".homeDoors .knowCell a", "/connections#connSuggest"]] } },
     "out-board": { "auth": false, "url": "/community/leaderboard", "actions": [["wait", 400]], "expect": { "visible": ["#board", "#boardList", "#boardWindow", "#signinTop", "#projTrig", "#boardCrown"], "hidden": ["#home", "#week", "#find", "#recruit", "#who", "#boardLoading", "#boardFailed", "#boardEmpty"], "href": [["#boardCrown a", "/community/week"]], "count": [["#boardList .commRow", 6]], "value": [["#boardWindow", "all"]], "attr": [["#craftTabs [data-craft=\"\"]", "aria-pressed", "true"], ["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community/leaderboard\"]", "aria-current", "page"]], "text": [["#boardList .commRow:first-child .mineRow__name", "Priya Nair"], ["#boardList .commRow:first-child .commNum", "18,420"], ["#boardList .commRow:first-child .mineRow__hint", "212 works shipped · 64 karma"], ["#boardNote", "Credits earned across every project, since each builder started."], ["#boardCrown", "Builder of the week: Ada Okafor, 1,240 credits, 19–25 Oct"]] } },
     "out-30d": { "auth": false, "url": "/community/leaderboard", "actions": [["wait", 400], ["select", "#boardWindow", "30d"], ["wait", 300]], "expect": { "count": [["#boardList .commRow", 3]], "value": [["#boardWindow", "30d"]], "text": [["#boardList .commRow:first-child .mineRow__name", "Ada Okafor"], ["#boardNote", "Credits earned in the last 30 days, across every project."]] } },

package/modules/ui-design/kit/fixtures/community-movers-none.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/movers with nobody to show (task 1002983): no newer builder shipped a work in the last 30 days, and no public project did — what the hub may show while its numbers are quiet.",
+  "window": { "start": "2026-09-28T09:30:00.000Z", "end": "2026-10-28T09:30:00.000Z" },
+  "rising": null,
+  "projects": []
+}

package/modules/ui-design/kit/fixtures/community-movers.json

@@ -0,0 +1,12 @@
+{
+  "_": "GET /community/movers (task 1002983): the rising builder and the projects on the move over the last 30 days, as community-movers.js answers — five projects, one with a long name, and the rising builder a newer builder than the crowns'.",
+  "window": { "start": "2026-09-28T09:30:00.000Z", "end": "2026-10-28T09:30:00.000Z" },
+  "rising": { "handle": "kofi-mensah", "github_login": "kofimensah", "display_name": "Kofi Mensah", "avatar_url": "/__kit/avatar.svg", "credits": 640, "tasks_shipped": 5 },
+  "projects": [
+    { "name": "Tidepool", "origin": "https://tidepool.example", "tasks_shipped": 23, "credits": 1840 },
+    { "name": "Lantern Atlas", "origin": "https://lantern-atlas.example", "tasks_shipped": 17, "credits": 2210 },
+    { "name": "The Long Weekend Collective's Field Notes and Recipes", "origin": "https://field-notes.example", "tasks_shipped": 9, "credits": 610 },
+    { "name": "Orbit Garden", "origin": "https://orbit-garden.example", "tasks_shipped": 4, "credits": 380 },
+    { "name": "Quill", "origin": "https://quill.example", "tasks_shipped": 1, "credits": 45 }
+  ]
+}

package/modules/ui-design/kit/serve.js

@@ -749,6 +749,13 @@ function communityCrowns(res, origin) {
     year: { ...year, winner: shown(year.winner), last: year.last ? { ...year.last, winner: shown(year.last.winner) } : null },
   });
 }
+// The movers (task 1002983): the fixture is already the route's answer — the 30 days, the
+// rising builder or null, and the projects on the move best first (community-movers.js).
+function communityMovers(res, origin) {
+  const f = heldFixture('community-movers');
+  if (stubStatus(res, f)) return;
+  return json(res, 200, { window: f.window, rising: f.rising ? withAvatar(f.rising, origin) : null, projects: f.projects || [] });
+}
 function scoutingRead(res, origin) {
   const f = heldFixture('scouting');
   if (stubStatus(res, f)) return;
@@ -788,6 +795,7 @@ const server = http.createServer((req, res) => {
     if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);
     if (rest === '/community/builder-of-the-week' && req.method === 'GET') return communityWeek(res, origin);
     if (rest === '/community/crowns' && req.method === 'GET') return communityCrowns(res, origin);
+    if (rest === '/community/movers' && req.method === 'GET') return communityMovers(res, origin);
     if (rest === '/scouting' && req.method === 'GET') return AUTH ? scoutingRead(res, origin) : json(res, 401, UNAUTH);
     if (rest === '/connections' && req.method === 'GET') return AUTH ? connRead(res, 'list', origin) : json(res, 401, UNAUTH);
     if (rest === '/connections/requests' && req.method === 'GET') return AUTH ? connRead(res, 'requests', origin) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.19",
+  "version": "1.23.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.19",
+      "version": "1.23.20",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.19",
+  "version": "1.23.20",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10503,5 +10503,11 @@
       "id": "1004902",
       "text": "The community page now opens on a Community home: the builder of the week, of the month and of the year side by side, how they are chosen, and a button to each community page. The leaderboard has its own page now, and Communit"
     }
+  ],
+  "1.23.20": [
+    {
+      "id": "1002983",
+      "text": "The Community home now shows a rising builder and the projects on the move this month, under the builders of the week, month and year."
+    }
   ]
 }

package/scripts/bongos/run-unit-tests.js

@@ -79,6 +79,10 @@ const INTEGRATION = new Set([
   // keeps the week's baseline rule, the year counts from a row's first snapshot inside
   // it, the pin under a hide and two racing writers. The DB-free sibling is community_crowns.
   'community_crowns_db',
+  // task 1002983: the rising builder and the projects on the move against real SQL — the
+  // year's baseline over 30 days, a quiet row's live total, hidden and private left out.
+  // The DB-free sibling is community_movers.
+  'community_movers_db',
   // bfg, bfg_write, memory_isolation, memory_pull and setup_smoke LEFT this set under task
   // 1004865: none of them ever needed a database. Each failed on a stale test harness (a fake
   // server without res.fail, a stub on the wrong module, an old error shape, a renamed session

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.19'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.20'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/community_movers.mjs

@@ -0,0 +1,280 @@
+// tests/community_movers.mjs — the rising builder and the projects on the move behind the
+// row under the crowns on the hub's /community home (task 1002983).
+//
+// DB-free. A fake pool answers each statement by its shape. Which snapshots open and close
+// the 30 days, and the baseline a quiet row brings, need a real Postgres:
+// tests/community_movers_db.mjs.
+//
+// What this pins:
+//   1. the statement: the crowns' period rows by the year's rule over the last 30 days, the
+//      numbers predicate, and a quiet row's live total as its baseline.
+//   2. the rising builder: under RISING_BASE_MAX before, at least one work, the crowns' tie
+//      order; a builder who may not be shown is not counted.
+//   3. the projects: named only on the map with the Public door, ranked by works then
+//      credits, at most PROJECTS_MAX, counting only builders who may be shown.
+//   4. the memo: the 30 days computed once per MOVERS_TTL_MS, who and which projects asked
+//      on every read.
+//   5. the route: no-store, the same body with or without credentials, the 500 envelope,
+//      and its own rate-limit scope.
+//
+// Run:  node tests/community_movers.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+const { rollupVisibleSql } = require('../modules/platform-identity/account-visibility.js');
+const { onMapSql } = require('../modules/platform-identity/projects-feed.js');
+const flat = (s) => s.replace(/\s+/g, ' ').trim();
+const NUMBERS = flat(rollupVisibleSql('pa'));
+const ON_MAP = flat(onMapSql('p'));
+
+// ---- fake engine ------------------------------------------------------------
+
+const isRows = (sql) => /^WITH act AS/.test(sql) && /LEFT JOIN per_project pp/.test(sql);
+const isWho = (sql) => /FROM platform_identity_accounts pa WHERE pa\.github_id = ANY\(\$1::bigint\[\]\)/.test(sql);
+const isNamed = (sql) => /FROM platform_identity_sso_clients c JOIN platform_identity_projects p/.test(sql);
+
+const engine = {
+  calls: [],
+  rows: [],          // the 30 days' statement's rows
+  shown: new Set(),  // github_ids the numbers predicate admits
+  named: {},         // client_id → { name, origin } on the map with the Public door
+  throwOn: null,
+  query: async (text, params = []) => {
+    const sql = flat(String(text));
+    engine.calls.push({ sql, params });
+    if (engine.throwOn && engine.throwOn(sql)) { engine.throwOn = null; throw new Error('boom'); }
+    if (isRows(sql)) return { rows: engine.rows };
+    if (isWho(sql)) {
+      const rows = params[0].filter((id) => engine.shown.has(id))
+        .map((id) => ({ github_id: id, handle: `h${id}`, github_login: `l${id}`, display_name: `D${id}`, avatar_url: null }));
+      return { rows };
+    }
+    if (isNamed(sql)) {
+      const rows = params[0].filter((c) => engine.named[c]).map((c) => ({ client_id: c, ...engine.named[c] }));
+      return { rows };
+    }
+    throw new Error(`fake pool: unexpected statement ${sql.slice(0, 80)}`);
+  },
+};
+function reset() {
+  Object.assign(engine, { calls: [], rows: [], shown: new Set(), named: {}, throwOn: null });
+  movers.clearMoversMemo();
+}
+const callsOf = (pred) => engine.calls.filter((c) => pred(c.sql));
+// One (project, builder) row as the statement returns it: deltas null for a quiet row.
+const r = (client, id, credits, ships, base, karma = 0) => ({
+  client_id: client, github_id: id, credits: credits == null ? null : String(credits),
+  tasks_shipped: ships == null ? null : String(ships), karma: credits == null ? null : String(karma), base_credits: String(base),
+});
+
+// Pin the module doorway (ADR 0083) BEFORE the modules load.
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool: engine,
+    corsPublicGet: () => (_req, res, next) => { res.set('Access-Control-Allow-Origin', '*'); next(); },
+    logger: () => ({ error: () => {}, info: () => {}, warn: () => {} }),
+  },
+};
+
+const movers = require('../modules/platform-identity/community-movers.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildRoutes = require('../modules/platform-identity/routes/community-leaderboard.js');
+
+const NOW = '2026-10-28T09:30:00.000Z';
+const read = (now = NOW) => movers.readMovers({ now: new Date(now), pool: engine });
+
+// ---- 1. the statement ---------------------------------------------------------
+
+await t('the 30 days: the crowns’ period rows by the year’s rule, the numbers predicate, a quiet row’s live total as its baseline', async () => {
+  reset();
+  const out = await read();
+  const [s] = callsOf(isRows);
+  assert.ok(s.sql.includes(NUMBERS), 'the leaderboard’s numbers predicate');
+  assert.match(s.sql, /COALESCE\(e\.credits, 0\)::bigint - COALESCE\(b\.credits, CASE WHEN act\.first_seen_at >= \$1::timestamptz THEN 0 ELSE f\.credits END, 0\) AS credits/, 'the year’s baseline: never a lifetime');
+  assert.match(s.sql, /WHERE b\.credits IS NOT NULL OR act\.first_seen_at >= \$1::timestamptz OR f\.credits IS NOT NULL \)/);
+  assert.match(s.sql, /COALESCE\(pp\.base_credits, a\.credits::bigint\) AS base_credits/, 'a row with no history in the 30 days brings its live total');
+  assert.match(s.sql, /LEFT JOIN per_project pp ON pp\.client_id = act\.client_id AND pp\.github_id = act\.github_id$/);
+  assert.deepEqual(s.params.map((d) => d.toISOString()), ['2026-09-28T09:30:00.000Z', NOW], 'rolling: the 30 days up to now');
+  assert.deepEqual(out, { window: { start: '2026-09-28T09:30:00.000Z', end: NOW }, rising: null, projects: [] });
+});
+
+// ---- 2. the rising builder ----------------------------------------------------
+
+await t('the rising builder: most credits among those under the base cap with a shipped work', async () => {
+  reset();
+  engine.rows = [
+    r('p1', '1', 900, 4, 500),            // a veteran: over the cap
+    r('p1', '2', 300, 2, movers.RISING_BASE_MAX - 1),
+    r('p1', '3', 400, 0, 0),              // no work shipped
+    r('p1', '4', 250, 1, 0),
+  ];
+  engine.shown = new Set(['1', '2', '3', '4']);
+  const { rising } = await read();
+  assert.deepEqual(rising, { handle: 'h2', github_login: 'l2', display_name: 'D2', avatar_url: null, credits: 300, tasks_shipped: 2 });
+  assert.doesNotMatch(JSON.stringify(rising), /github_id|karma/, 'the crown’s fields and no more');
+});
+
+await t('the base is summed across every project, a quiet one included, and exactly the cap is over it', async () => {
+  reset();
+  engine.rows = [
+    r('p1', '2', 300, 2, 40),
+    r('p2', '2', null, null, 60),         // quiet: its live total is its baseline
+    r('p1', '4', 250, 1, 0),
+  ];
+  engine.shown = new Set(['2', '4']);
+  assert.equal((await read()).rising.handle, 'h4', '40 + 60 is not under 100');
+});
+
+await t('ties go to works shipped, then karma, then handle', async () => {
+  reset();
+  engine.rows = [r('p1', '5', 200, 1, 0, 9), r('p1', '6', 200, 2, 0, 0), r('p1', '7', 200, 2, 0, 1)];
+  engine.shown = new Set(['5', '6', '7']);
+  assert.equal((await read()).rising.handle, 'h7');
+  reset();
+  engine.rows = [r('p1', '8', 200, 2, 0, 1), r('p1', '7', 200, 2, 0, 1)];
+  engine.shown = new Set(['7', '8']);
+  assert.equal((await read()).rising.handle, 'h7', 'handle, by code unit');
+});
+
+await t('a builder who may not be shown is not the rising builder, and nobody takes it in their place unless they qualify', async () => {
+  reset();
+  engine.rows = [r('p1', '2', 300, 2, 0), r('p1', '4', 250, 1, 0)];
+  engine.shown = new Set(['4']);
+  assert.equal((await read()).rising.handle, 'h4');
+  const [who] = callsOf(isWho);
+  assert.ok(who.sql.includes(NUMBERS), 'who is shown: the numbers predicate');
+  assert.deepEqual(who.params[0].sort(), ['2', '4']);
+  reset();
+  engine.rows = [r('p1', '2', 300, 2, 0)];
+  assert.equal((await read()).rising, null);
+});
+
+// ---- 3. the projects on the move ------------------------------------------------
+
+await t('the projects: named only on the map with the Public door, by works then credits, at most PROJECTS_MAX', async () => {
+  reset();
+  engine.shown = new Set(['1', '2', '3']);
+  engine.rows = [
+    r('a', '1', 100, 3, 0), r('a', '2', 50, 1, 0),   // 4 works, 150
+    r('b', '1', 900, 4, 0),                          // 4 works, 900
+    r('c', '3', 10, 1, 0),
+    r('d', '3', 10, 1, 0),
+    r('e', '3', 20, 1, 0),
+    r('f', '3', 5, 1, 0),
+    r('g', '3', 0, 0, 0),                            // nothing shipped
+    r('hidden', '3', 999, 9, 0),                     // private or stealth: not named
+  ];
+  for (const c of ['a', 'b', 'c', 'd', 'e', 'f', 'g']) engine.named[c] = { name: c.toUpperCase(), origin: `https://${c}.example` };
+  const { projects } = await read();
+  assert.deepEqual(projects.map((p) => p.name), ['B', 'A', 'E', 'C', 'D'], 'works, then credits, then name');
+  assert.equal(projects.length, movers.PROJECTS_MAX);
+  assert.deepEqual(projects[1], { name: 'A', origin: 'https://a.example', tasks_shipped: 4, credits: 150 });
+  const [named] = callsOf(isNamed);
+  assert.ok(named.sql.includes(`${ON_MAP} AND p.visibility = 'public'`), 'a profile’s naming rule (task 1003558)');
+  assert.doesNotMatch(JSON.stringify(projects), /client_id|github_id|"hidden"/);
+});
+
+await t('a project counts only the builders who may be shown', async () => {
+  reset();
+  engine.shown = new Set(['1']);
+  engine.rows = [r('a', '1', 100, 1, 0), r('a', '2', 500, 5, 0), r('b', '2', 900, 9, 0)];
+  engine.named = { a: { name: 'A', origin: 'https://a.example' }, b: { name: 'B', origin: 'https://b.example' } };
+  const { projects } = await read();
+  assert.deepEqual(projects, [{ name: 'A', origin: 'https://a.example', tasks_shipped: 1, credits: 100 }]);
+  assert.deepEqual(callsOf(isNamed)[0].params[0], ['a'], 'a project only a hidden builder moved is not even asked about');
+});
+
+// ---- 4. the memo ------------------------------------------------------------------
+
+await t('the 30 days are computed once per MOVERS_TTL_MS; who and which projects are asked every read', async () => {
+  reset();
+  engine.rows = [r('a', '2', 300, 2, 0)];
+  engine.shown = new Set(['2']);
+  engine.named = { a: { name: 'A', origin: 'https://a.example' } };
+  const t0 = Date.parse(NOW);
+  assert.equal((await read(t0)).rising.handle, 'h2');
+  engine.shown = new Set();            // the builder hides
+  delete engine.named.a;               // and the project closes its door
+  const hid = await read(t0 + movers.MOVERS_TTL_MS - 1);
+  assert.equal(hid.rising, null, 'a hide beats the memo');
+  assert.deepEqual(hid.projects, [], 'so does a closed door');
+  assert.equal(hid.window.end, NOW, 'inside the memo: the window it was computed for');
+  assert.equal(callsOf(isRows).length, 1);
+  assert.equal(callsOf(isWho).length, 2);
+  await read(t0 + movers.MOVERS_TTL_MS);
+  assert.equal(callsOf(isRows).length, 2, 'stale: computed again');
+  await read(t0 - 1000);
+  assert.equal(callsOf(isRows).length, 3, 'a clock that runs backwards is never served from the memo');
+});
+
+// ---- 5. the route -----------------------------------------------------------------
+
+function serve() {
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildRoutes());
+  const server = app.listen(0, '127.0.0.1');
+  return new Promise((resolve) => server.once('listening', () => resolve(server)));
+}
+function get(server, path_, headers = {}) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port: server.address().port, path: path_, headers }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body, json: body ? JSON.parse(body) : null }));
+    }).on('error', reject);
+  });
+}
+
+const server = await serve();
+const URL_ = '/api/bongos/community/movers';
+
+await t('GET /community/movers: the window, the rising builder and the projects; no-store; CORS-open; the same for every viewer', async () => {
+  reset();
+  engine.rows = [r('a', '2', 300, 2, 0)];
+  engine.shown = new Set(['2']);
+  engine.named = { a: { name: 'A', origin: 'https://a.example' } };
+  const anon = await get(server, URL_);
+  assert.equal(anon.status, 200);
+  assert.equal(anon.headers['cache-control'], 'no-store');
+  assert.equal(anon.headers['access-control-allow-origin'], '*');
+  assert.deepEqual(Object.keys(anon.json), ['window', 'rising', 'projects']);
+  assert.equal(anon.json.rising.handle, 'h2');
+  assert.equal(anon.json.projects[0].name, 'A');
+  assert.doesNotMatch(anon.body, /github_id|client_id/);
+  const signedIn = await get(server, URL_, { Cookie: 'bongos_session=x', Authorization: 'Bearer y' });
+  assert.equal(signedIn.body, anon.body, 'the route reads no session');
+});
+
+await t('a failure is the 500 envelope, never a stack', async () => {
+  reset();
+  engine.throwOn = isRows;
+  const res = await get(server, URL_);
+  assert.equal(res.status, 500);
+  assert.equal(res.json.error.code, 'community_movers_failed');
+  assert.doesNotMatch(res.body, /boom/);
+});
+
+await t('its own rate-limit budget, not the board’s, the week’s or the crowns’', () => {
+  const { _internals } = buildRoutes;
+  assert.equal(_internals.MOVERS_READ_RATE_SCOPE, 'community-movers-read');
+  assert.equal(new Set([_internals.MOVERS_READ_RATE_SCOPE, _internals.CROWNS_READ_RATE_SCOPE, _internals.READ_RATE_SCOPE, _internals.WEEK_READ_RATE_SCOPE]).size, 4);
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);