@bongos/core 1.23.19 → 1.23.21

package/modules/copy-desk/tests/copy_chrome_pages.mjs

@@ -0,0 +1,127 @@
+// modules/copy-desk/tests/copy_chrome_pages.mjs — the shared page chrome as its
+// own pages (task 1004904), pure.
+//
+// The skip link, top bar, navigation and footer are on every page of a surface.
+// A real page's reading must not carry them, and each surface must gain one
+// page per chrome section, each line once. Run over a small hand-made reading
+// (the rules) and over the committed artifacts (the real data holds them).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const chrome = require('../chrome-pages.js');
+const pageData = require('../page-data.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const L = (key, section, text, placement, row) => ({ key, section, text, placement, ...(row || {}) });
+const READINGS = {
+  counts: { pages: 3, lines: 9, placed: 3, shared: 5, unplaced: 1 },
+  pages: [
+    { id: 'landing:index', surface: 'landing', reading_hash: 'h-index', files_hash: 'f1', states_read: ['in'], lines: [
+      L('L0001', 'skip link', 'Skip to content', 'shared', { file: 'shell.js', line: 9, string_id: 'a1' }),
+      L('L0002', 'top bar', 'Projects', 'shared', { file: 'nav.js', line: 3, string_id: 'a2' }),
+      L('L0003', 'hero', 'Build here', 'placed', { file: 'index.html', line: 4, string_id: 'a3' }),
+    ] },
+    { id: 'landing:account', surface: 'landing', reading_hash: 'h-acct', counts: { lines: 5, placed: 1, shared: 3, unplaced: 1 }, files_hash: 'f2', states_read: ['in', 'out'], lines: [
+      L('L0001', 'skip link', 'Skip to content', 'shared'),
+      L('L0002', 'top bar', 'Projects', 'shared'),
+      L('L0003', 'top bar', 'Sign in', 'shared'),
+      L('L0004', 'hero', 'Your account', 'placed'),
+      L('L0005', 'list', 'Something unplaced', 'unplaced'),
+    ] },
+    // No surface on the reading: it is read from the id.
+    { id: 'status:explore', reading_hash: 'h-exp', files_hash: 'f3', lines: [L('L0001', 'hero', 'Explore', 'placed')] },
+  ],
+};
+const INVENTORY = {
+  counts: { pages: 3, surfaces: 2 },
+  surfaces: [{ id: 'landing', pages: 2 }, { id: 'status', pages: 1 }],
+  pages: [
+    { id: 'landing:index', surface: 'landing', module: 'public-landing', page: 'index', title: 'Home', path: '/', url: 'https://{apex}/', files: ['index.html'] },
+    { id: 'landing:account', surface: 'landing', module: 'public-landing', page: 'account', title: 'Account', path: '/account', url: 'https://{apex}/account', files: ['account.html'] },
+    { id: 'status:explore', surface: 'status', module: 'status-ui', page: 'explore', title: 'Explore', path: '/explore', url: 'https://status.{apex}/explore', files: ['explore.html'] },
+  ],
+};
+
+const split = chrome.splitReadings(READINGS);
+const byId = (rd, id) => rd.pages.find((p) => p.id === id);
+
+test('a real page no longer carries its chrome, and keeps its own lines and keys', () => {
+  assert.deepEqual(byId(split.readings, 'landing:index').lines.map((l) => [l.key, l.section]), [['L0003', 'hero']]);
+  assert.deepEqual(byId(split.readings, 'landing:account').lines.map((l) => l.key), ['L0004', 'L0005']);
+  assert.equal(byId(split.readings, 'landing:index').reading_hash, 'h-index', 'a draft on the reading stays on it');
+  assert.deepEqual(byId(split.readings, 'landing:account').counts, { lines: 2, placed: 1, shared: 0, unplaced: 1 });
+});
+
+test('each chrome section becomes one page per surface, every distinct line once, in first-seen order', () => {
+  const top = byId(split.readings, 'landing:top-bar');
+  assert.deepEqual(top.lines.map((l) => [l.key, l.text]), [['L0001', 'Projects'], ['L0002', 'Sign in']]);
+  assert.deepEqual(byId(split.readings, 'landing:skip-link').lines.map((l) => l.text), ['Skip to content']);
+  assert.equal(byId(split.readings, 'landing:footer'), undefined, 'a surface with no footer gains no footer page');
+  assert.equal(byId(split.readings, 'status:top-bar'), undefined, 'a surface with no chrome gains no chrome page');
+});
+
+test('a chrome line keeps the registry row of its first occurrence that has one', () => {
+  const top = byId(split.readings, 'landing:top-bar').lines[0];
+  assert.deepEqual([top.file, top.line, top.string_id, top.placement], ['nav.js', 3, 'a2', 'shared']);
+});
+
+test('the reading totals follow the pages', () => {
+  assert.equal(split.readings.counts.pages, 5);
+  assert.equal(split.readings.counts.lines, 1 + 2 + 1 + 2 + 1);
+  assert.equal(split.readings.counts.shared, 3);
+});
+
+test('the inventory gains the same pages, after their surface, opening on a page that shows them', () => {
+  const inv = chrome.addChromePages(INVENTORY, split.chrome);
+  assert.deepEqual(inv.pages.map((p) => p.id), ['landing:index', 'landing:account', 'status:explore', 'landing:top-bar', 'landing:skip-link']);
+  const top = inv.pages.find((p) => p.id === 'landing:top-bar');
+  assert.deepEqual([top.surface, top.page, top.title, top.url], ['landing', 'top-bar', 'Top bar', 'https://{apex}/']);
+  assert.deepEqual(top.files, ['nav.js']);
+  assert.equal(inv.counts.pages, 5);
+  assert.deepEqual(inv.surfaces.map((s) => [s.id, s.pages]), [['landing', 4], ['status', 1]]);
+});
+
+test('a chrome page id is told from a page id', () => {
+  assert.equal(chrome.isChromePageId('landing:top-bar'), true);
+  assert.equal(chrome.isChromePageId('landing:index'), false);
+});
+
+test('only a shared line in a chrome section is chrome', () => {
+  assert.equal(chrome.isChromeLine(L('L1', 'top bar', 'x', 'placed')), false);
+  assert.equal(chrome.isChromeLine(L('L1', 'hero', 'x', 'shared')), false);
+  assert.equal(chrome.isChromeLine(L('L1', 'top bar', 'x', 'shared')), true);
+});
+
+test('the committed readings: no real page lists a skip link, top bar, navigation or footer line', () => {
+  const rd = pageData.loadReadings();
+  assert.equal(rd.ok, true);
+  for (const p of rd.data.pages) {
+    if (chrome.isChromePageId(p.id)) continue;
+    const bad = p.lines.filter(chrome.isChromeLine);
+    assert.equal(bad.length, 0, `${p.id} still lists ${bad.length} chrome lines`);
+  }
+});
+
+test('the committed data: every surface that had a top bar has a Top bar page, in both reads', () => {
+  const rd = pageData.loadReadings().data;
+  const inv = pageData.loadInventory().data;
+  for (const surface of ['builders', 'landing', 'status']) {
+    const id = `${surface}:top-bar`;
+    const r = rd.pages.find((p) => p.id === id);
+    assert.ok(r && r.lines.length > 0, `${id} in the readings`);
+    assert.ok(inv.pages.find((p) => p.id === id), `${id} in the inventory`);
+    assert.equal(new Set(r.lines.map((l) => l.text)).size, r.lines.length, `${id} lists each line once`);
+  }
+  assert.equal(rd.pages.length, inv.pages.length, 'the two reads name the same pages');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -70,7 +70,7 @@ const stripComments = (src) => src
 // Task 1004435 added routes/copy-desk-artist.js (one artist's approved pages, a
 // read) and artist-stats.js's readArtistPages under it.
 const ROUTE_FILES = fs.readdirSync(path.join(MODULE_DIR, 'routes')).filter((f) => f.endsWith('.js')).sort().map((f) => `routes/${f}`);
-const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'docx.js', 'page-decisions.js', 'artist-stats.js', 'auto-close.js', ...ROUTE_FILES];
+const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'chrome-pages.js', 'docx.js', 'page-decisions.js', 'artist-stats.js', 'auto-close.js', ...ROUTE_FILES];
 
 console.log('copy-desk: NO LIVE CMS');
 

package/modules/platform-identity/builder-of-the-week.js

@@ -53,13 +53,15 @@ function crownedWeek(now = new Date()) {
 
 const isoDate = (d) => d.toISOString().slice(0, 10);
 
-// The winner of [start, end) among eligible builders, or null; the week's, and the month's
-// and year's (community-crowns.js). Arithmetic is bigint for the leaderboard's reason: the
+// The per-(project, builder) deltas over [$1, $2] among eligible builders, as the CTEs
+// `act` and `per_project`: the week's, month's and year's (computeWinner below) and the 30
+// days' (community-movers.js). Arithmetic is bigint for the leaderboard's reason: the
 // columns are instance-reported int4. `fromFirstSnapshot` is the YEAR's rule (owner,
 // 2026-10-27): a row with no snapshot before the start, and not first seen inside, counts
 // from its first snapshot inside instead of not at all, since history began in late
 // September 2026 and the rule above would leave that year to new builders alone.
-async function computeWinner(start, end, pool, { fromFirstSnapshot = false } = {}) {
+// `base_credits` is what a row had at the start by the same rule.
+function periodRowsSql({ fromFirstSnapshot = false } = {}) {
   const base = (col) => (fromFirstSnapshot
     ? `COALESCE(b.${col}, CASE WHEN act.first_seen_at >= $1::timestamptz THEN 0 ELSE f.${col} END, 0)`
     : `COALESCE(b.${col}, 0)`);
@@ -74,17 +76,17 @@ async function computeWinner(start, end, pool, { fromFirstSnapshot = false } = {
             LIMIT 1
          ) f ON true`
     : '';
-  const { rows } = await pool.query(
-    `WITH act AS (
+  return `WITH act AS (
        SELECT a.client_id, a.github_id, a.first_seen_at, pa.handle, pa.github_login
          FROM platform_identity_builder_project_activity a
          JOIN platform_identity_accounts pa ON pa.github_id = a.github_id
         WHERE ${rollupVisibleSql('pa')}
      ), per_project AS (
-       SELECT act.github_id, act.handle, act.github_login,
+       SELECT act.client_id, act.github_id, act.handle, act.github_login,
               COALESCE(e.credits, 0)::bigint - ${base('credits')}             AS credits,
               COALESCE(e.tasks_shipped, 0)::bigint - ${base('tasks_shipped')} AS tasks_shipped,
-              COALESCE(e.karma, 0)::bigint - ${base('karma')}                 AS karma
+              COALESCE(e.karma, 0)::bigint - ${base('karma')}                 AS karma,
+              ${base('credits')}::bigint                                      AS base_credits
          FROM act
          LEFT JOIN LATERAL (
            SELECT s.credits, s.tasks_shipped, s.karma
@@ -103,7 +105,13 @@ async function computeWinner(start, end, pool, { fromFirstSnapshot = false } = {
             LIMIT 1
          ) b ON true${firstInside}
         WHERE b.credits IS NOT NULL OR act.first_seen_at >= $1::timestamptz${fromFirstSnapshot ? ' OR f.credits IS NOT NULL' : ''}
-     )
+     )`;
+}
+
+// The winner of [start, end) among eligible builders, or null.
+async function computeWinner(start, end, pool, { fromFirstSnapshot = false } = {}) {
+  const { rows } = await pool.query(
+    `${periodRowsSql({ fromFirstSnapshot })}
      SELECT github_id, sum(credits)::bigint AS credits, sum(tasks_shipped)::bigint AS tasks_shipped
        FROM per_project
       GROUP BY github_id, handle, github_login
@@ -201,8 +209,9 @@ module.exports = {
   crownedWeek,
   clearCrownMemo,
   ARCHIVE_WEEKS,
-  // for community-crowns.js (the month and the year)
+  // for community-crowns.js (the month and the year) and community-movers.js (the 30 days)
   computeWinner,
+  periodRowsSql,
   crownOnce,
   isoDate,
 };

package/modules/platform-identity/community-leaderboard.js

@@ -231,4 +231,7 @@ module.exports = {
   MAX_LIMIT,
   MAX_OFFSET,
   MAX_DISCIPLINE_CHARS,
+  // for community-movers.js (the rising builder), so who is shown and the tie order are one rule
+  eligibleIdentities,
+  compareRows,
 };

package/modules/platform-identity/community-movers.js

@@ -0,0 +1,152 @@
+// modules/platform-identity/community-movers.js — the rising builder and the projects on the
+// move, the read behind GET /community/movers for the row under the crowns on the hub's
+// /community home (community spec D7 items 1–2; task 1002983, goal 1000110 CT7).
+//
+// THE 30 DAYS are rolling, up to now, and read from the snapshot history by the year's
+// baseline rule (builder-of-the-week.js periodRowsSql, fromFirstSnapshot): a row first seen
+// inside counts from zero, a row with no snapshot before them from its first one inside (an
+// undercount, never a lifetime).
+//
+// THE RISING BUILDER (owner, 2026-10-28): the most credits earned in the 30 days among the
+// builders who had under RISING_BASE_MAX before them, with at least one work shipped in
+// them; ties as the crowns. "Before" is each row's baseline, and a row with no history in
+// the 30 days at all counts its live total, so a veteran's quiet projects still count.
+//
+// THE PROJECTS ON THE MOVE (owner, 2026-10-28): the most works shipped in the 30 days, then
+// credits, the top PROJECTS_MAX. Only the builders the leaderboard may show are counted
+// (spec D8), and a project is named only where a profile may name it: on the map with the
+// Public door (task 1003558); private and stealth projects are left off, not anonymised.
+//
+// TWO HALVES, as the leaderboard: the 30 days' rows (one snapshot probe per activity row)
+// are memoised per pool for MOVERS_TTL_MS; who and which projects may be shown is asked on
+// every read, so a hide, a private account or a closed door beats the memo. Viewer-
+// independent; github_id and client_id never cross the projection.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { periodRowsSql } = require('./builder-of-the-week');
+const { eligibleIdentities, compareRows, windowStart } = require('./community-leaderboard');
+const { onMapSql } = require('./projects-feed');
+
+const WINDOW = '30d';
+const RISING_BASE_MAX = 100;
+const PROJECTS_MAX = 5;
+const MOVERS_TTL_MS = 30 * 1000;
+
+// Every eligible (project, builder) row's 30 days: [{ clientId, githubId, credits,
+// tasks_shipped, karma, base }]. A row the period rule leaves out moved nowhere in them, so
+// its deltas are zero and its baseline is its live total.
+async function computeRows(start, end, pool) {
+  const { rows } = await pool.query(
+    `${periodRowsSql({ fromFirstSnapshot: true })}
+     SELECT a.client_id, a.github_id, pp.credits, pp.tasks_shipped, pp.karma,
+            COALESCE(pp.base_credits, a.credits::bigint) AS base_credits
+       FROM act
+       JOIN platform_identity_builder_project_activity a
+         ON a.client_id = act.client_id AND a.github_id = act.github_id
+       LEFT JOIN per_project pp
+         ON pp.client_id = act.client_id AND pp.github_id = act.github_id`,
+    [start, end],
+  );
+  return rows.map((r) => ({
+    clientId: String(r.client_id),
+    githubId: String(r.github_id),
+    credits: Number(r.credits || 0),
+    tasks_shipped: Number(r.tasks_shipped || 0),
+    karma: Number(r.karma || 0),
+    base: Number(r.base_credits || 0),
+  }));
+}
+
+// pool → { at, start, end, promise }. Concurrent reads share one in-flight computation; a
+// failed one is dropped so the next read retries.
+const rowsMemo = new Map();
+function windowRows(now, pool) {
+  const m = rowsMemo.get(pool);
+  const at = now.getTime();
+  if (m && at >= m.at && at - m.at < MOVERS_TTL_MS) return m;
+  const start = windowStart(WINDOW, now);
+  const entry = { at, start, end: now, promise: computeRows(start, now, pool) };
+  entry.promise.catch(() => { if (rowsMemo.get(pool) === entry) rowsMemo.delete(pool); });
+  rowsMemo.set(pool, entry);
+  return entry;
+}
+
+// The projects among `clientIds` a profile may name, now: Map clientId → { name, origin }.
+async function namedProjects(clientIds, pool) {
+  if (clientIds.length === 0) return new Map();
+  const { rows } = await pool.query(
+    `SELECT c.client_id, p.name, p.origin
+       FROM platform_identity_sso_clients c
+       JOIN platform_identity_projects p ON p.origin = c.origin
+      WHERE c.client_id = ANY($1::text[])
+        AND ${onMapSql('p')} AND p.visibility = 'public'`,
+    [clientIds],
+  );
+  return new Map(rows.map((r) => [String(r.client_id), { name: r.name, origin: r.origin }]));
+}
+
+// Sums `rows` per `key`, from zero.
+function sumBy(rows, key) {
+  const out = new Map();
+  for (const r of rows) {
+    const k = r[key];
+    const s = out.get(k) || { credits: 0, tasks_shipped: 0, karma: 0, base: 0 };
+    s.credits += r.credits;
+    s.tasks_shipped += r.tasks_shipped;
+    s.karma += r.karma;
+    s.base += r.base;
+    out.set(k, s);
+  }
+  return out;
+}
+
+function risingBuilder(rows, identities) {
+  const ranked = [...sumBy(rows, 'githubId')]
+    .filter(([, s]) => s.base < RISING_BASE_MAX && s.tasks_shipped >= 1)
+    .map(([id, s]) => ({ ...identities.get(id), credits: s.credits, tasks_shipped: s.tasks_shipped, karma: s.karma }))
+    .sort(compareRows);
+  if (!ranked.length) return null;
+  const { handle, github_login, display_name, avatar_url, credits, tasks_shipped } = ranked[0];
+  return { handle, github_login, display_name, avatar_url, credits, tasks_shipped };
+}
+
+const byText = (x, y) => (x < y ? -1 : x > y ? 1 : 0);
+function projectsOnTheMove(rows, named) {
+  return [...sumBy(rows.filter((r) => named.has(r.clientId)), 'clientId')]
+    .filter(([, s]) => s.tasks_shipped >= 1)
+    .map(([id, s]) => ({ ...named.get(id), tasks_shipped: s.tasks_shipped, credits: s.credits }))
+    .sort((a, b) => (b.tasks_shipped - a.tasks_shipped) || (b.credits - a.credits)
+      || byText(String(a.name), String(b.name)) || byText(String(a.origin), String(b.origin)))
+    .slice(0, PROJECTS_MAX);
+}
+
+// readMovers — { window: { start, end }, rising, projects }: the window as ISO instants,
+// rising null when nobody qualifies or may be shown, projects best first (at most
+// PROJECTS_MAX). `now` is injectable for tests.
+async function readMovers({ now = new Date(), pool = defaultPool } = {}) {
+  const w = windowRows(now, pool);
+  const rows = await w.promise;
+  // Only a builder or project with a shipped work in the 30 days can be on either card.
+  const shipped = rows.filter((r) => r.tasks_shipped > 0);
+  const identities = await eligibleIdentities([...new Set(shipped.map((r) => r.githubId))], pool);
+  const shown = rows.filter((r) => identities.has(r.githubId));
+  const named = await namedProjects([...new Set(shown.filter((r) => r.tasks_shipped > 0).map((r) => r.clientId))], pool);
+  return {
+    window: { start: w.start.toISOString(), end: w.end.toISOString() },
+    rising: risingBuilder(shown, identities),
+    projects: projectsOnTheMove(shown, named),
+  };
+}
+
+function clearMoversMemo() {
+  rowsMemo.clear();
+}
+
+module.exports = {
+  readMovers,
+  clearMoversMemo,
+  RISING_BASE_MAX,
+  PROJECTS_MAX,
+  MOVERS_TTL_MS,
+};

package/modules/platform-identity/routes/community-leaderboard.js

@@ -9,7 +9,8 @@
 // It also serves GET /community/builder-of-the-week (spec D5, task 1002981), the
 // board's weekly crown, from ../builder-of-the-week.js on the same terms, and GET
 // /community/crowns (task 1004902), the week, month and year for the hub's /community
-// page, from ../community-crowns.js.
+// page, from ../community-crowns.js, and GET /community/movers (task 1002983), the rising
+// builder and the projects on the move under them, from ../community-movers.js.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -19,6 +20,7 @@ const api = require('../../../src/module-api');
 const leaderboard = require('../community-leaderboard');
 const builderOfTheWeek = require('../builder-of-the-week');
 const communityCrowns = require('../community-crowns');
+const communityMovers = require('../community-movers');
 const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, corsPublicGet } = api;
@@ -31,6 +33,8 @@ const WEEK_READ_RATE_SCOPE = 'builder-of-the-week-read';
 const weekReadRateLimit = createReadRateLimit({ scope: WEEK_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
 const CROWNS_READ_RATE_SCOPE = 'community-crowns-read';
 const crownsReadRateLimit = createReadRateLimit({ scope: CROWNS_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
+const MOVERS_READ_RATE_SCOPE = 'community-movers-read';
+const moversReadRateLimit = createReadRateLimit({ scope: MOVERS_READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
 
 module.exports = function communityLeaderboardRoutes() {
   const router = express.Router();
@@ -109,7 +113,23 @@ module.exports = function communityLeaderboardRoutes() {
     }
   });
 
+  router.use('/community/movers', corsPublicGet('/community/movers'));
+
+  // rank: public — the rising builder and the projects on the move, the last 30 days (task
+  // 1002983). Takes no parameters and writes nothing. Viewer-independent; no-store so a
+  // builder who hides leaves it on the next read (ADR 0171 D5).
+  router.get('/community/movers', moversReadRateLimit, async (req, res) => {
+    try {
+      const out = await communityMovers.readMovers({ pool });
+      res.set('Cache-Control', 'no-store');
+      res.json(out);
+    } catch (err) {
+      api.logger('platform-identity').error({ err: err && err.message }, 'GET /community/movers failed');
+      res.fail('community_movers_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 
-module.exports._internals = { READ_RATE_LIMIT, READ_RATE_SCOPE, WEEK_READ_RATE_SCOPE, CROWNS_READ_RATE_SCOPE };
+module.exports._internals = { READ_RATE_LIMIT, READ_RATE_SCOPE, WEEK_READ_RATE_SCOPE, CROWNS_READ_RATE_SCOPE, MOVERS_READ_RATE_SCOPE };

package/modules/public-landing/public/community-movers-none.states.json

@@ -0,0 +1,15 @@
+{
+  "_": "The community home with no movers to show (task 1002983; fixtures/community-movers-none.json): the row under the crowns stands with one line in each card.",
+  "page": "/community",
+  "surface": "public-landing",
+  "modes": ["dark"],
+  "modeQuery": false,
+  "stub": { "fixtures": { "community-movers": "community-movers-none" } },
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/me/guild-", "/scouting$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "/scouting", "\\b40[13]\\b", "Unauthorized", "Forbidden"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "out-home-movers-none": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#homeMovers", "#moveRising .commMsg", "#moveNone", "#moversRule"], "count": [["#moveProjects .commRow", 0]], "text": [["#moveRising .commMsg", "No rising builder in the last 30 days."], ["#moveNone", "No public project shipped a work in the last 30 days."]] } }
+  },
+  "reducedMotion": { "auth": false, "actions": [["wait", 400]] }
+}

package/modules/public-landing/public/community.html

@@ -7,15 +7,17 @@
      spec docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8). Who is building, across every
      project, as five sub-pages of the bar's Community menu (owner, 2026-10-27), all served
      from this one file: /community is the community home (task 1004902: the builders of the
-     week, month and year, and a door to each page), /community/leaderboard the leaderboard,
+     week, month and year, under them the rising builder and the projects on the move (task
+     1002983), and a door to each page), /community/leaderboard the leaderboard,
      /community/week the builder of the week (task 1002981, spec D5), /community/find the
      builder search, /community/recruiters the builders who hide their numbers but are open
      to recruiters.
      The script shows the section the path names and marks it current in the menu.
      VIEWING IS UNGATED (ADR 0217 D1): the home, the leaderboard, the builder of the week and
-     the search are the same for every viewer, signed in or not. All four reads are public,
+     the search are the same for every viewer, signed in or not. All five reads are public,
      viewer-independent routes (modules/platform-identity/routes/community-leaderboard.js,
-     which also serves the builder of the week and the crowns, and community-search.js),
+     which also serves the builder of the week, the crowns and the movers, and
+     community-search.js),
      which decide WHO appears through account-visibility.js; these pages add no rule of
      their own. The one viewer-relative page is the recruiter list: drawn only from a 200 of
      GET /scouting, whose door (a project owner, or project.curate) is the server's, never
@@ -126,8 +128,18 @@
 .homeLast strong{font-weight:500;color:var(--ink);}
 .homeDoors{list-style:none;display:flex;flex-wrap:wrap;gap:10px 12px;margin:10px 0 0;padding:0;}
 .homeDoors .btn{text-transform:none;}
+/* the row under the crowns (task 1002983): the rising builder in the first column, the
+   projects on the move across the other two as board rows with no face */
+.homeMovers{margin-top:14px;}
+.homeMovers .homeWide{grid-column:span 2;align-items:stretch;}
+.moveRows{margin:0;}
+.moveRows .commRow{grid-template-columns:3ch minmax(0,1fr) auto;padding:10px 0;}
+.moveRows a{display:inline-block;min-height:24px;padding:3px 0;line-height:18px;color:var(--ink);
+  text-decoration:underline;text-decoration-color:var(--accent);text-underline-offset:4px;}
+.moveRows a:focus-visible{outline:2px solid var(--focus);outline-offset:3px;}
 @media (max-width:760px){
   .homeCrowns{grid-template-columns:minmax(0,1fr);}
+  .homeMovers .homeWide{grid-column:auto;}
 }
 @media (max-width:480px){
   .commCrown{grid-template-columns:minmax(0,1fr);}
@@ -226,6 +238,14 @@
         <li class="homeCard"><h3 class="commSub">Builder of the year</h3><p class="crownWhen" id="crownYearWhen"></p><div class="homeBody" id="crownYear"></div><p class="homeLast" id="crownYearLast" hidden></p></li>
       </ul>
       <p class="commNote" id="homeRule">Each is the builder who earned the most {{currency}} across every project in that time, among the builders who shipped at least one work in it. A tie goes to whoever shipped more works, then to whoever earned more karma. Builders who hide their numbers or keep their account private are not counted. The week and the month are decided once, when they end; the year shows the leader so far, and is decided on 1 January.</p>
+      <!-- THE ROW UNDER THE CROWNS (task 1002983; owner, 2026-10-28): the rising builder and
+           the projects on the move, the last 30 days, from GET /community/movers
+           (community-movers.js decides both). Its own read: a failed one drops only this row. -->
+      <ul class="homeCrowns homeMovers" id="homeMovers" hidden>
+        <li class="homeCard"><h3 class="commSub">Rising builder</h3><p class="crownWhen">The last 30 days</p><div class="homeBody" id="moveRising"></div></li>
+        <li class="homeCard homeWide"><h3 class="commSub">Projects on the move</h3><p class="crownWhen">The last 30 days</p><ol class="commRows moveRows" id="moveProjects"></ol><p class="commMsg" id="moveNone" hidden>No public project shipped a work in the last 30 days.</p></li>
+      </ul>
+      <p class="commNote" id="moversRule" hidden>The rising builder is the one who earned the most {{currency}} in the last 30 days, among the builders who had earned under 100 {{currency}} before them and shipped at least one work in them. Projects on the move are the public projects that shipped the most works in the last 30 days, then earned the most {{currency}}. Builders who hide their numbers or keep their account private are not counted in either.</p>
       <h3 class="commSub" id="doorsH">Community pages</h3>
       <ul class="homeDoors" aria-labelledby="doorsH">
         <li><a class="btn ghost" href="/community/leaderboard">Leaderboard</a></li>
@@ -677,6 +697,44 @@
     });
   }
 
+  // ── the row under the crowns: the rising builder and the projects on the move ──
+  // (task 1002983) community-movers.js decides both; a failed read leaves the row down.
+  function moveRow(p, i) {
+    var li = el('li', 'commRow');
+    li.appendChild(el('span', 'commPlace', String(i + 1)));
+    var main = el('div', 'mineRow__main');
+    var name = String(p.name || 'A project');
+    var href = safeHttpUrl(p.origin);
+    if (href) {
+      var a = el('a', 'mineRow__name', name);
+      a.setAttribute('href', href);
+      main.appendChild(a);
+    } else main.appendChild(el('div', 'mineRow__name', name));
+    main.appendChild(el('p', 'mineRow__hint', num(p.credits).toLocaleString() + ' ' + UNIT + ' earned'));
+    li.appendChild(main);
+    var works = el('div', 'commCredits');
+    var n = num(p.tasks_shipped);
+    works.appendChild(el('span', 'commNum', String(n)));
+    works.appendChild(el('span', 'commUnit', n === 1 ? 'work shipped' : 'works shipped'));
+    li.appendChild(works);
+    return li;
+  }
+  function loadMovers() {
+    return read('/community/movers').then(function (r) {
+      if (!r.ok) return;
+      var box = $('moveRising');
+      box.textContent = '';
+      if (r.data.rising) fillCrown(box, r.data.rising);
+      else box.appendChild(el('p', 'commMsg', 'No rising builder in the last 30 days.'));
+      var list = $('moveProjects');
+      list.textContent = '';
+      arr(r.data.projects).forEach(function (p, i) { if (p) list.appendChild(moveRow(p, i)); });
+      $('moveNone').hidden = list.children.length > 0;
+      $('homeMovers').hidden = false;
+      $('moversRule').hidden = false;
+    });
+  }
+
   // ── the search ──────────────────────────────────────────────────────────────
   function say(text, kind) {
     var s = $('findStatus');
@@ -806,7 +864,7 @@
   if (view.title) document.title = document.title + ' · ' + view.title;
   $('signinTop').setAttribute('href', '/api/bongos/auth/web/start?return=' + view.path + '&repos=1');
   if (VIEW === 'leaderboard') { loadBoard(); read('/community/builder-of-the-week').then(crownLine); }
-  if (VIEW === 'home') loadHome();
+  if (VIEW === 'home') { loadHome(); loadMovers(); }
   else if (VIEW === 'week') loadWeek();
   else if (VIEW === 'recruiters') bar.ready.then(function (me) { if (me) loadRecruit(); else showRecruit('recruitDoor'); });
   else bar.ready.then(function (me) { if (me) loadOwned(me, $(VIEW === 'find' ? 'findFor' : 'boardFor')); });

package/modules/public-landing/public/community.states.json

@@ -8,7 +8,7 @@
   "ignoreConsole": ["/api/(gds|bongos)/me", "/scouting", "\\b40[13]\\b", "Unauthorized", "Forbidden"],
   "ignoreControls": [".vh"],
   "states": {
-    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#home", "#homeCrowns", "#crownWeek .crownName", "#crownMonth .crownName", "#crownYear .crownName", "#homeRule", "#signinTop"], "hidden": ["#board", "#week", "#find", "#recruit", "#who", "#homeLoading", "#homeFailed", "#crownYearLast", ".homeDoors .knowCell"], "count": [[".homeDoors li:not([hidden])", 4]], "href": [[".homeDoors li:first-child a", "/community/leaderboard"]], "attr": [["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community\"]", "aria-current", "page"]], "text": [["#crownWeekWhen", "26 Oct – 1 Nov 2026"], ["#crownWeek .crownName", "Ada Okafor"], ["#crownMonthWhen", "October 2026"], ["#crownMonth .crownName", "Priya Nair"], ["#crownMonth .crownNums div:first-child .commNum", "6,120"], ["#crownYearWhen", "2026 so far, since 27 Sep 2026"], ["#crownYear .crownName", "Maximiliana van der Berghe-Lindqvist"]] } },
+    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#home", "#homeCrowns", "#crownWeek .crownName", "#crownMonth .crownName", "#crownYear .crownName", "#homeRule", "#signinTop", "#homeMovers", "#moveRising .crownName", "#moversRule"], "hidden": ["#board", "#week", "#find", "#recruit", "#who", "#homeLoading", "#homeFailed", "#crownYearLast", ".homeDoors .knowCell", "#moveNone"], "count": [[".homeDoors li:not([hidden])", 4], ["#moveProjects .commRow", 5]], "href": [[".homeDoors li:first-child a", "/community/leaderboard"], ["#moveProjects .commRow:first-child a", "https://tidepool.example/"]], "attr": [["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community\"]", "aria-current", "page"]], "text": [["#crownWeekWhen", "26 Oct – 1 Nov 2026"], ["#crownWeek .crownName", "Ada Okafor"], ["#crownMonthWhen", "October 2026"], ["#crownMonth .crownName", "Priya Nair"], ["#crownMonth .crownNums div:first-child .commNum", "6,120"], ["#crownYearWhen", "2026 so far, since 27 Sep 2026"], ["#crownYear .crownName", "Maximiliana van der Berghe-Lindqvist"], ["#moveRising .crownName", "Kofi Mensah"], ["#moveProjects .commRow:first-child .commNum", "23"], ["#moveProjects .commRow:first-child .mineRow__hint", "1,840 credits earned"]] } },
     "in": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#home", "#homeCrowns", "#who", ".homeDoors .knowCell"], "hidden": ["#board", "#signinTop", "#homeFailed"], "count": [[".homeDoors li:not([hidden])", 5]], "href": [[".homeDoors .knowCell a", "/connections#connSuggest"]] } },
     "out-board": { "auth": false, "url": "/community/leaderboard", "actions": [["wait", 400]], "expect": { "visible": ["#board", "#boardList", "#boardWindow", "#signinTop", "#projTrig", "#boardCrown"], "hidden": ["#home", "#week", "#find", "#recruit", "#who", "#boardLoading", "#boardFailed", "#boardEmpty"], "href": [["#boardCrown a", "/community/week"]], "count": [["#boardList .commRow", 6]], "value": [["#boardWindow", "all"]], "attr": [["#craftTabs [data-craft=\"\"]", "aria-pressed", "true"], ["#commTrig", "aria-current", "true"], ["#menuCommunity a[href=\"/community/leaderboard\"]", "aria-current", "page"]], "text": [["#boardList .commRow:first-child .mineRow__name", "Priya Nair"], ["#boardList .commRow:first-child .commNum", "18,420"], ["#boardList .commRow:first-child .mineRow__hint", "212 works shipped · 64 karma"], ["#boardNote", "Credits earned across every project, since each builder started."], ["#boardCrown", "Builder of the week: Ada Okafor, 1,240 credits, 19–25 Oct"]] } },
     "out-30d": { "auth": false, "url": "/community/leaderboard", "actions": [["wait", 400], ["select", "#boardWindow", "30d"], ["wait", 300]], "expect": { "count": [["#boardList .commRow", 3]], "value": [["#boardWindow", "30d"]], "text": [["#boardList .commRow:first-child .mineRow__name", "Ada Okafor"], ["#boardNote", "Credits earned in the last 30 days, across every project."]] } },

package/modules/ui-design/kit/fixtures/community-movers-none.json

@@ -0,0 +1,6 @@
+{
+  "_": "GET /community/movers with nobody to show (task 1002983): no newer builder shipped a work in the last 30 days, and no public project did — what the hub may show while its numbers are quiet.",
+  "window": { "start": "2026-09-28T09:30:00.000Z", "end": "2026-10-28T09:30:00.000Z" },
+  "rising": null,
+  "projects": []
+}

package/modules/ui-design/kit/fixtures/community-movers.json

@@ -0,0 +1,12 @@
+{
+  "_": "GET /community/movers (task 1002983): the rising builder and the projects on the move over the last 30 days, as community-movers.js answers — five projects, one with a long name, and the rising builder a newer builder than the crowns'.",
+  "window": { "start": "2026-09-28T09:30:00.000Z", "end": "2026-10-28T09:30:00.000Z" },
+  "rising": { "handle": "kofi-mensah", "github_login": "kofimensah", "display_name": "Kofi Mensah", "avatar_url": "/__kit/avatar.svg", "credits": 640, "tasks_shipped": 5 },
+  "projects": [
+    { "name": "Tidepool", "origin": "https://tidepool.example", "tasks_shipped": 23, "credits": 1840 },
+    { "name": "Lantern Atlas", "origin": "https://lantern-atlas.example", "tasks_shipped": 17, "credits": 2210 },
+    { "name": "The Long Weekend Collective's Field Notes and Recipes", "origin": "https://field-notes.example", "tasks_shipped": 9, "credits": 610 },
+    { "name": "Orbit Garden", "origin": "https://orbit-garden.example", "tasks_shipped": 4, "credits": 380 },
+    { "name": "Quill", "origin": "https://quill.example", "tasks_shipped": 1, "credits": 45 }
+  ]
+}

package/modules/ui-design/kit/serve.js

@@ -749,6 +749,13 @@ function communityCrowns(res, origin) {
     year: { ...year, winner: shown(year.winner), last: year.last ? { ...year.last, winner: shown(year.last.winner) } : null },
   });
 }
+// The movers (task 1002983): the fixture is already the route's answer — the 30 days, the
+// rising builder or null, and the projects on the move best first (community-movers.js).
+function communityMovers(res, origin) {
+  const f = heldFixture('community-movers');
+  if (stubStatus(res, f)) return;
+  return json(res, 200, { window: f.window, rising: f.rising ? withAvatar(f.rising, origin) : null, projects: f.projects || [] });
+}
 function scoutingRead(res, origin) {
   const f = heldFixture('scouting');
   if (stubStatus(res, f)) return;
@@ -788,6 +795,7 @@ const server = http.createServer((req, res) => {
     if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);
     if (rest === '/community/builder-of-the-week' && req.method === 'GET') return communityWeek(res, origin);
     if (rest === '/community/crowns' && req.method === 'GET') return communityCrowns(res, origin);
+    if (rest === '/community/movers' && req.method === 'GET') return communityMovers(res, origin);
     if (rest === '/scouting' && req.method === 'GET') return AUTH ? scoutingRead(res, origin) : json(res, 401, UNAUTH);
     if (rest === '/connections' && req.method === 'GET') return AUTH ? connRead(res, 'list', origin) : json(res, 401, UNAUTH);
     if (rest === '/connections/requests' && req.method === 'GET') return AUTH ? connRead(res, 'requests', origin) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.19",
+  "version": "1.23.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.19",
+      "version": "1.23.21",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.19",
+  "version": "1.23.21",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",