@bongos/core 1.23.19 → 1.23.20

package/tests/community_movers_db.mjs

@@ -0,0 +1,147 @@
+// tests/community_movers_db.mjs — task 1002983 (the rising builder and the projects on the
+// move; real DB).
+//
+// Proves against real SQL what a fake pool cannot (tests/community_movers.mjs): the 30 days
+// keep the year's baseline rule (a lifetime brought into them counts from its first snapshot
+// inside, a row first seen inside from zero), a quiet row's live total counts toward the
+// "under 100 before" test, a hidden builder counts nowhere, and a private project is never
+// named, however much it shipped.
+//
+// The read is global (every eligible builder on the hub), so the fixture's 30 days end in
+// March 2099: a shared database's real builders have no snapshot there, so they ship nothing
+// in them and the shipped-work floor keeps them out.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION set
+// (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/community_movers_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const { readMovers, clearMoversMemo } = require('../modules/platform-identity/community-movers.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`community_movers_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const R = 90298301, V = 90298302, Q = 90298303, L = 90298304, N = 90298305, S = 90298306, HIDDEN = 90298307;
+const IDS = [R, V, Q, L, N, S, HIDDEN];
+const P1 = 't1002983-p1', P2 = 't1002983-p2', P3 = 't1002983-p3', PRIV = 't1002983-priv';
+const CLIENTS = [P1, P2, P3, PRIV];
+const origin = (c) => `https://${c}.example`;
+const NOW = new Date('2099-03-12T10:00:00.000Z'); // the 30 days open 2099-02-10T10:00Z
+const OLD = new Date('2098-06-01T00:00:00Z');
+const d = (iso) => new Date(iso);
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [CLIENTS.map(origin)]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [CLIENTS]).catch(() => {});
+}
+async function account(id, handle, { hide = false } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, handle, profile_state, account_visibility, hide_stats, terms_accepted_at)
+     VALUES ($1, $2, $2, $2, 'active', 'public', $3, now())`,
+    [id, handle, hide],
+  );
+}
+async function project(client, name, visibility) {
+  await q(`INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin) VALUES ($1, 'x', $2, $3)`, [client, name, origin(client)]);
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, description, featured, status, visibility, visibility_source)
+     VALUES ($1, $2, 'described', false, 'active', $3, 'control-plane')`,
+    [origin(client), name, visibility],
+  );
+}
+// One (project, builder) row: its live totals, when the hub first saw it, and its snapshots.
+async function row(client, id, live, firstSeen, history) {
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma, first_seen_at) VALUES ($1, $2, $3, 0, 0, $4)`,
+    [client, id, live, firstSeen],
+  );
+  for (const [when, credits, ships] of history) {
+    await q(
+      `INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) VALUES ($1, $2, $3, $4, 0, $5)`,
+      [client, id, credits, ships, d(when)],
+    );
+  }
+}
+const read = () => { clearMoversMemo(); return readMovers({ now: NOW, pool }); };
+const who = (w) => w && [w.handle, w.credits, w.tasks_shipped];
+const strip = (ps) => ps.map((p) => [p.name, p.tasks_shipped, p.credits]);
+
+let pass = 0;
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_004_projects.sql', 'platform_identity_005_builder_activity.sql',
+    'platform_identity_007_profile_consent.sql', 'platform_identity_008_handle.sql',
+    'platform_identity_011_project_visibility.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_019_terms_acceptance.sql', 'platform_identity_020_visibility_pull.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_032_weekly_features.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  for (const [id, h] of [[R, 'r'], [V, 'v'], [Q, 'q'], [L, 'l'], [N, 'n'], [S, 's']]) await account(id, `t1002983-${h}`);
+  await account(HIDDEN, 't1002983-hidden', { hide: true });
+  await project(P1, 'Alpha', 'public');
+  await project(P2, 'Beta', 'public');
+  await project(PRIV, 'Shut', 'private');
+
+  // R: 40 before the 30 days, then 300 and two works in them — the rising builder.
+  await row(P1, R, 340, OLD, [['2099-02-01T00:00:00Z', 40, 0], ['2099-03-01T00:00:00Z', 340, 2]]);
+  // V: a veteran — 5000 before, 900 and four works in them.
+  await row(P1, V, 5900, OLD, [['2099-02-01T00:00:00Z', 5000, 50], ['2099-03-01T00:00:00Z', 5900, 54]]);
+  // Q: 400 and three works on a project first seen inside (from zero), but 800 on a project
+  // with no history in the 30 days at all, so Q had 800 before them and is not rising.
+  await row(P2, Q, 400, d('2099-02-14T00:00:00Z'), [['2099-02-15T00:00:00Z', 400, 3]]);
+  await row(P3, Q, 800, OLD, []);
+  // L: a lifetime brought into the 30 days — no snapshot before them, seen before
+  // first_seen_at existed. Counted from its first snapshot inside: 150 and a work, never 90150.
+  await row(P1, L, 90150, null, [['2099-02-20T00:00:00Z', 90000, 40], ['2099-03-02T00:00:00Z', 90150, 41]]);
+  // N: first seen inside, so from zero: 250 and a work.
+  await row(P2, N, 250, d('2099-02-12T00:00:00Z'), [['2099-02-12T00:00:00Z', 250, 1]]);
+  // S: seven works on the private project.
+  await row(PRIV, S, 70, d('2099-02-11T00:00:00Z'), [['2099-02-11T00:00:00Z', 70, 7]]);
+  // HIDDEN out-earns and out-ships everyone on Alpha, and the leaderboard may not show them.
+  await row(P1, HIDDEN, 9000, OLD, [['2099-02-01T00:00:00Z', 0, 0], ['2099-03-01T00:00:00Z', 9000, 9]]);
+
+  const first = await read();
+  same([first.window.start, first.window.end], ['2099-02-10T10:00:00.000Z', '2099-03-12T10:00:00.000Z'], 'the 30 days up to now');
+  same(who(first.rising), ['t1002983-r', 300, 2], 'rising: R’s 300 — V, Q and L had 100 or more before (Q by a quiet project, L by its first snapshot), and hidden counts nowhere');
+  same(strip(first.projects), [['Alpha', 7, 1350], ['Beta', 4, 650]],'projects: works then credits; L counted from its first snapshot, hidden not counted, the private project never named');
+  same(first.projects[0].origin, origin(P1), 'a project links to its own address');
+  same(JSON.stringify(first).match(/github_id|client_id/), null, 'github_id and client_id never cross');
+
+  await q(`UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1`, [R]);
+  const hid = await readMovers({ now: NOW, pool }); // inside the memo
+  same(who(hid.rising), ['t1002983-n', 250, 1], 'R hides: the next one under the cap rises, without waiting for the memo');
+  same(strip(hid.projects), [['Alpha', 5, 1050], ['Beta', 4, 650]], 'and R’s numbers leave Alpha too');
+
+  await q(`UPDATE platform_identity_projects SET visibility = 'stealth' WHERE origin = $1`, [origin(P1)]);
+  same(strip((await readMovers({ now: NOW, pool })).projects), [['Beta', 4, 650]],'a project that goes stealth leaves the strip on the next read');
+
+  console.log(`\ncommunity_movers_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/hub_community_page.mjs

@@ -17,11 +17,12 @@
 //     its refusals; the recruiter list as a door signed out, a refusal on a 403, and rows
 //     only from a 200 — name, face and login, never the ranked half's numbers; the builder
 //     of the week as one line on the board and as its own page, drawn as the server sent it;
-//     the home's three crowns, its empty and failed states, and its doors
+//     the home's three crowns, its empty and failed states, and its doors; the row under
+//     them (task 1002983), the rising builder and the projects on the move, from its own read
 //   • the Community menu on every page that wears the hub's bar (apex-only where the page
 //     also serves a child), folded into the Projects band on phones
 //   • the routes: the five paths served on the hub's apex only
-//   • the kit: the states files, and the stub answering as the five reads do
+//   • the kit: the states files, and the stub answering as the six reads do
 //
 // DB-free. Run:  node --test tests/hub_community_page.mjs
 
@@ -51,6 +52,7 @@ const SEARCH_JS = fs.readFileSync(path.join(PI, 'builder-search.js'), 'utf8');
 const SUBPAGES = [['/community', 'Community home'], ['/community/leaderboard', 'Leaderboard'], ['/community/week', 'Builder of the week'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
 const WEEK_JS = fs.readFileSync(path.join(PI, 'builder-of-the-week.js'), 'utf8');
 const CROWNS_JS = fs.readFileSync(path.join(PI, 'community-crowns.js'), 'utf8');
+const MOVERS_JS = fs.readFileSync(path.join(PI, 'community-movers.js'), 'utf8');
 
 // ── 1. the markup ────────────────────────────────────────────────────────────
 
@@ -119,7 +121,8 @@ test('the home states the month’s and year’s rule, and it is the module’s;
   assert.match(rule, /The week and the month are decided once, when they end; the year shows the leader so far, and is decided on 1 January\./);
   assert.match(CROWNS_JS, /ON CONFLICT \(period, period_start\) DO NOTHING/);
   assert.match(CROWNS_JS, /computeWinner\(start, now, pool, \{ fromFirstSnapshot: true \}\)/, 'the year so far is live');
-  for (const id of ['homeFailed', 'homeCrowns', 'crownYearLast']) assert.match(home, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  for (const id of ['homeFailed', 'homeCrowns', 'crownYearLast', 'homeMovers', 'moversRule', 'moveNone']) assert.match(home, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+  assert.ok(home.indexOf('id="homeMovers"') > home.indexOf('id="homeRule"') && home.indexOf('id="homeMovers"') < home.indexOf('id="doorsH"'), 'the row under the crowns and their rule, above the doors (owner decision 5, task 1004902)');
   const doors = [...home.split('<ul class="homeDoors" aria-labelledby="doorsH">')[1].split('</ul>')[0].matchAll(/<li( class="knowCell" hidden)?><a class="btn ghost" href="([^"]+)">([^<]+)<\/a><\/li>/g)];
   assert.deepEqual(doors.map((m) => [m[2], m[3], !!m[1]]), [
     ['/community/leaderboard', 'Leaderboard', false], ['/community/week', 'Builder of the week', false], ['/community/find', 'Find a builder', false],
@@ -127,6 +130,19 @@ test('the home states the month’s and year’s rule, and it is the module’s;
   ], 'one door per page, the menu’s order; Builders you may know signed in only, like its menu item');
 });
 
+test('the movers’ rule is the module’s: the base cap, the shipped-work floor, the projects’ order and who is counted (task 1002983)', () => {
+  const rule = MAIN.split('<p class="commNote" id="moversRule" hidden>')[1].split('</p>')[0];
+  const cap = MOVERS_JS.match(/const RISING_BASE_MAX = (\d+);/)[1];
+  assert.match(rule, new RegExp(`the most \\{\\{currency\\}\\} in the last 30 days, among the builders who had earned under ${cap} \\{\\{currency\\}\\} before them and shipped at least one work in them\\.`));
+  assert.match(MOVERS_JS, /const WINDOW = '30d';/);
+  assert.match(MOVERS_JS, /s\.base < RISING_BASE_MAX && s\.tasks_shipped >= 1/, 'the cap and the floor the page states are the ones applied');
+  assert.match(rule, /Projects on the move are the public projects that shipped the most works in the last 30 days, then earned the most \{\{currency\}\}\./);
+  assert.match(MOVERS_JS, /\(b\.tasks_shipped - a\.tasks_shipped\) \|\| \(b\.credits - a\.credits\)/);
+  assert.match(MOVERS_JS, /onMapSql\('p'\)\} AND p\.visibility = 'public'/, '“public projects”: on the map with the Public door');
+  assert.match(rule, /Builders who hide their numbers or keep their account private are not counted in either\./);
+  assert.match(MOVERS_JS, /eligibleIdentities/);
+});
+
 test('the window dropdown and the query limits are the routes’ own (boundary-forced copies)', () => {
   const days = BOARD_JS.match(/const WINDOW_DAYS = Object\.freeze\(\{([^}]*)\}\);/);
   const windows = [...days[1].matchAll(/'?(\w+)'?:/g)].map((m) => m[1]);
@@ -144,12 +160,12 @@ test('the window dropdown and the query limits are the routes’ own (boundary-f
   assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
 });
 
-test('the script builds no markup from strings, reads only the six routes, and never re-ranks or reads the ranked tier', () => {
+test('the script builds no markup from strings, reads only the seven routes, and never re-ranks or reads the ranked tier', () => {
   assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
-  // every path literal in the code: the API base, the six reads, the five sub-pages, the
+  // every path literal in the code: the API base, the seven reads, the five sub-pages, the
   // sign-in door and the hall's invite box the Recruit door opens (task 1002292)
   const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
-  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/builder-of-the-week', '/community/crowns', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/community/week', '/my-projects', '/scouting']);
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/builders/watch', '/community', '/community/builder-of-the-week', '/community/crowns', '/community/find', '/community/leaderboard', '/community/movers', '/community/recruiters', '/community/search', '/community/week', '/my-projects', '/scouting']);
   assert.doesNotMatch(CODE, /method:/, 'it only reads');
   assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
   assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
@@ -201,8 +217,14 @@ const CROWNS = () => ({
   month: { start: '2026-10-01', end: '2026-11-01', first_crown: null, winner: WINNER('bo', 6120, 1, { display_name: null, avatar_url: 'javascript:alert(1)' }) },
   year: { start: '2026-01-01', since: '2026-09-27', last: null, winner: WINNER('cy', 9870, 31) },
 });
+const MOVERS = () => ({
+  window: { start: '2026-09-28T09:30:00.000Z', end: '2026-10-28T09:30:00.000Z' },
+  rising: WINNER('kofi', 640, 5, { display_name: 'Kofi <b>M</b>' }),
+  projects: [{ name: 'Tide <i>pool</i>', origin: 'https://tidepool.example', tasks_shipped: 23, credits: 1840 }, { name: 'Quill', origin: 'javascript:alert(1)', tasks_shipped: 1, credits: 45 }],
+});
 const READS = () => ({
   '/community/crowns': { status: 200, body: CROWNS() },
+  '/community/movers': { status: 200, body: MOVERS() },
   '/community/builder-of-the-week': { status: 200, body: WEEK() },
   '/community/leaderboard?window=all': { status: 200, body: { window: 'all', count: 99, results: [ROW(26, 'ana', 1200), ROW(27, 'bo', 1500, { tasks_shipped: 1, karma: 0, avatar_url: 'javascript:alert(1)', display_name: null })] } },
   '/community/leaderboard?window=30d': { status: 200, body: { window: '30d', results: [ROW(1, 'cy', 40)] } },
@@ -271,7 +293,7 @@ test('each path shows its one section, marks its menu items current and names it
 
 test('the home: one read, the three crowns with their periods, names as text, and nothing asked about projects', async () => {
   const ui = await boot({ pathname: '/community' });
-  assert.deepEqual(ui.gets(), ['/api/bongos/community/crowns']);
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/crowns', '/api/bongos/community/movers']);
   assert.equal(ui.$('homeLoading').hidden, true);
   assert.equal(ui.$('homeFailed').hidden, true);
   assert.equal(ui.$('homeCrowns').hidden, false);
@@ -286,7 +308,7 @@ test('the home: one read, the three crowns with their periods, names as text, an
   assert.equal(find(ui.$('crownYear'), 'mineRow__host').textContent, '@cy');
   assert.equal(ui.$('crownYearLast').hidden, true, 'no year crowned yet');
   const signedIn = await boot({ pathname: '/community', me: { github_login: 'owner' } });
-  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/crowns'], 'signed in, the same one read: no Recruit door here');
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/crowns', '/api/bongos/community/movers'], 'signed in, the same two reads: no Recruit door here');
   assert.equal(signedIn.$('homeCrowns').textContent, ui.$('homeCrowns').textContent, 'the same crowns for every viewer');
 });
 
@@ -332,6 +354,45 @@ test('the home: a failed read is an alert, never three empty crowns; a rate limi
   assert.match((await boot({ pathname: '/community', reads })).$('homeFailed').textContent, /^Too many requests/);
 });
 
+test('the row under the crowns: the rising builder as a crown, the projects in the server’s order, names as text, a link only to a web address (task 1002983)', async () => {
+  const ui = await boot({ pathname: '/community' });
+  assert.equal(ui.$('homeMovers').hidden, false);
+  assert.equal(ui.$('moversRule').hidden, false);
+  assert.equal(find(ui.$('moveRising'), 'crownName').textContent, 'Kofi <b>M</b>', 'a name is text, never markup');
+  assert.equal(find(ui.$('moveRising'), 'crownNums').textContent, '640credits5works shipped');
+  const rows = kids(ui.$('moveProjects'));
+  assert.deepEqual(rows.map((r) => find(r, 'commPlace').textContent), ['1', '2'], 'positions in the order sent');
+  const first = find(rows[0], 'mineRow__name');
+  assert.equal(first.tag, 'a');
+  assert.equal(first.attrs.href, 'https://tidepool.example/');
+  assert.equal(first.textContent, 'Tide <i>pool</i>');
+  assert.equal(find(rows[0], 'mineRow__hint').textContent, (1840).toLocaleString() + ' credits earned');
+  assert.equal(find(rows[0], 'commCredits').textContent, '23works shipped');
+  assert.equal(find(rows[1], 'mineRow__name').tag, 'div', 'an address that is not http(s) is never a link');
+  assert.equal(find(rows[1], 'commCredits').textContent, '1work shipped', 'one work, singular');
+  assert.equal(ui.$('moveNone').hidden, true);
+  const signedIn = await boot({ pathname: '/community', me: { github_login: 'owner' } });
+  assert.equal(signedIn.$('homeMovers').textContent, ui.$('homeMovers').textContent, 'the same row for every viewer');
+});
+
+test('the row under the crowns: nobody to show is one line in each card; a failed read drops only the row', async () => {
+  const reads = READS();
+  reads['/community/movers'] = { status: 200, body: { window: {}, rising: null, projects: [] } };
+  const quiet = await boot({ pathname: '/community', reads });
+  assert.equal(quiet.$('homeMovers').hidden, false);
+  assert.equal(find(quiet.$('moveRising'), 'commMsg').textContent, 'No rising builder in the last 30 days.');
+  assert.equal(kids(quiet.$('moveProjects')).length, 0);
+  assert.equal(quiet.$('moveNone').hidden, false);
+  for (const answer of [{ status: 500, body: {} }, { status: 429, body: {} }, { reject: true }]) {
+    reads['/community/movers'] = answer;
+    const failed = await boot({ pathname: '/community', reads });
+    assert.equal(failed.$('homeMovers').hidden, true);
+    assert.equal(failed.$('moversRule').hidden, true, 'no rule for cards that are not there');
+    assert.equal(failed.$('homeCrowns').hidden, false, 'the crowns stand on their own');
+    assert.equal(failed.$('homeFailed').hidden, true, 'and no alert: the row is the home’s extra');
+  }
+});
+
 test('the leaderboard, signed out: the all-time board in the server’s order with the server’s places, and nothing asked about the viewer', async () => {
   const ui = await boot();
   assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all', '/api/bongos/community/builder-of-the-week']);
@@ -747,6 +808,8 @@ test('the kit renders each sub-page for everyone, the empty board, and a project
   assert.equal(states.states['out-find'].url, '/community/find');
   assert.equal(states.states['out-week'].url, '/community/week');
   assert.ok(states.states['out-board'].expect.visible.includes('#boardCrown'), 'the board carries the crown line');
+  assert.ok(states.states.out.expect.visible.includes('#homeMovers'), 'the home carries the row under the crowns (task 1002983)');
+  assert.equal(json('community-movers-none.states.json').stub.fixtures['community-movers'], 'community-movers-none');
   // the home's other answers (task 1004902): before the first month, nobody, and a new year
   for (const [file, fixture] of [['community-crowns-first.states.json', 'community-crowns-first'], ['community-crowns-none.states.json', 'community-crowns-none'], ['community-crowns-new-year.states.json', 'community-crowns-new-year']]) {
     assert.equal(json(file).stub.fixtures['community-crowns'], fixture);
@@ -790,7 +853,7 @@ async function call(origin, p) {
   return { status: res.status, body: await res.json() };
 }
 
-test('the kit stub answers the crowns, the board, the builder of the week, the search and the recruiting door the way the routes do', async () => {
+test('the kit stub answers the crowns, the movers, the board, the builder of the week, the search and the recruiting door the way the routes do', async () => {
   const s = await stub();
   try {
     const crowns = await call(s.origin, '/community/crowns');
@@ -798,6 +861,12 @@ test('the kit stub answers the crowns, the board, the builder of the week, the s
     const { week: w, month: m, year: y } = crowns.body;
     assert.deepEqual([Object.keys(w).sort(), Object.keys(m).sort(), Object.keys(y).sort()], [['end', 'start', 'winner'], ['end', 'first_crown', 'start', 'winner'], ['last', 'since', 'start', 'winner']], 'community-crowns.js’s shape');
     assert.ok([w.winner, m.winner, y.winner].every((r) => r && Object.keys(r).sort().join() === 'avatar_url,credits,display_name,github_login,handle,tasks_shipped'), 'the module’s projection, no github_id');
+    const movers = await call(s.origin, '/community/movers');
+    assert.deepEqual(Object.keys(movers.body), ['window', 'rising', 'projects'], 'community-movers.js’s shape');
+    assert.equal(Object.keys(movers.body.rising).sort().join(), 'avatar_url,credits,display_name,github_login,handle,tasks_shipped', 'the crown’s projection, no github_id');
+    assert.ok(movers.body.projects.length && movers.body.projects.every((p) => Object.keys(p).sort().join() === 'credits,name,origin,tasks_shipped'), 'a project’s name, address and two numbers, no client_id');
+    const ships = movers.body.projects.map((p) => p.tasks_shipped);
+    assert.deepEqual(ships, [...ships].sort((a, b) => b - a), 'most works first');
     const week = await call(s.origin, '/community/builder-of-the-week');
     assert.deepEqual(Object.keys(week.body).sort(), ['past', 'week', 'winner'], 'the route’s three keys');
     assert.ok(week.body.winner && week.body.past.length, 'a crown and the weeks before it');

package/tests/privacy_matrix.mjs

@@ -158,7 +158,11 @@ function identitySentinels(acct) {
 //                the year so far and last year (task 1004902): a crown IS stats, so the board's
 //                rule. Each account in turn is made the winner of all three, so the reads'
 //                own predicates decide: 'listed' | 'absent'
-//   directory  GET /scouting               Recruiter — 'full' | 'name-only' | 'absent'
+//   movers     GET /community/movers        Anon · Builder · Recruiter — the rising builder and the
+//                projects on the move (task 1002983): a card IS stats, so the board's rule, and
+//                a project's totals are the sum of what may be shown. Each account in turn is
+//                the one who moved, so the reads' own predicates decide: 'listed' | 'absent'
+//   directory  GET /scouting              Recruiter — 'full' | 'name-only' | 'absent'
 //   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
 //   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
 //   guild      GET /guilds/:slug            Anon · Builder · Recruiter · Self — the guild page's PUBLIC
@@ -174,13 +178,13 @@ function identitySentinels(acct) {
 //                people the guild page already shows them — shown_publicly AND existence;
 //                hide_stats never hides membership, and private or provisional is never listed
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', crowns: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
 };
 
 // ===========================================================================
@@ -303,6 +307,9 @@ function weekOf(key) {
 // THE ACCOUNT that won the month, the year so far and last year (task 1004902); the
 // crowns test makes each fixture account the winner in turn.
 let CROWNED = 'PUB';
+// THE ACCOUNT that moved in the 30 days, on MX_CLIENT's project (task 1002983); the movers
+// test makes each fixture account the one in turn.
+let MOVED = 'PUB';
 
 const pool = {
   query: async (text, params = []) => {
@@ -393,6 +400,20 @@ const pool = {
       }));
       return { rows, rowCount: rows.length };
     }
+    // THE MOVERS (task 1002983): the 30 days' rows carry the floor on the act CTE, as the
+    // year's; MOVED had nothing before them. The project names are MX_CLIENT's.
+    if (/^WITH act AS/.test(sql) && /LEFT JOIN per_project pp/.test(sql)) {
+      const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'movers');
+      const rows = ACCOUNTS.filter((a) => a.key === MOVED).filter(accountFilter(where, [])).map((a) => ({
+        client_id: MX_CLIENT.client_id, github_id: a.github_id, credits: String(ROLLUP[a.github_id].credits),
+        tasks_shipped: String(ROLLUP[a.github_id].works_shipped), karma: String(ROLLUP[a.github_id].karma), base_credits: '0',
+      }));
+      return { rows, rowCount: rows.length };
+    }
+    if (/FROM platform_identity_sso_clients c JOIN platform_identity_projects p ON p\.origin = c\.origin WHERE c\.client_id = ANY\(\$1::text\[\]\)/.test(sql)) {
+      const rows = (params[0] || []).includes(MX_CLIENT.client_id) ? [{ client_id: MX_CLIENT.client_id, name: MX_CLIENT.name, origin: MX_CLIENT.origin }] : [];
+      return { rows, rowCount: rows.length };
+    }
     // ... the year so far: computeWinner's act CTE carries the floor, then the leader's re-read
     if (/^WITH act AS/.test(sql) && /\) f ON true/.test(sql)) {
       const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'year so far');
@@ -868,6 +889,24 @@ test('the crowns — the month, the year so far and last year only for shown, pu
   } finally { CROWNED = 'PUB'; }
 });
 
+test('the movers — the rising builder and a project’s totals only from shown, public, active accounts, the same for every viewer', async () => {
+  const { clearMoversMemo } = require('../modules/platform-identity/community-movers.js');
+  try {
+    for (const k of KEYS) {
+      MOVED = k;
+      clearMoversMemo(); // the 30 days are memoised: a new mover is a new computation
+      const seen = [];
+      for (const who of [ANON, STRANGER, RECRUITER]) seen.push(await get(who, '/api/bongos/community/movers'));
+      for (const r of seen.slice(1)) assert.equal(r.text, seen[0].text, `${r.who} got different movers with ${k} moving`);
+      const { rising, projects } = seen[0].json;
+      const listed = MATRIX[k].movers === 'listed';
+      assert.equal(!!rising && rising.handle === ACCT[k].handle, listed, `${k} as the rising builder: expected ${MATRIX[k].movers}`);
+      assert.deepEqual(projects.map((p) => p.tasks_shipped), listed ? [ROLLUP[ACCT[k].github_id].works_shipped] : [], `${k}'s works in a project's totals: expected ${MATRIX[k].movers}`);
+      assert.doesNotMatch(seen[0].text, /github_id|client_id/, 'github_id and client_id never cross');
+    }
+  } finally { MOVED = 'PUB'; }
+});
+
 test('the recruiting directory — the recruiter sees the full and name-only tiers; Anon and Builder are refused', async () => {
   const r = await get(RECRUITER, '/api/bongos/scouting');
   assert.equal(r.status, 200);
@@ -910,7 +949,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/community/builder-of-the-week', '/community/crowns', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/community/builder-of-the-week', '/community/crowns', '/community/movers', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);