@bongos/core 1.23.9 → 1.23.11

package/tests/hub_community_page.mjs

@@ -0,0 +1,493 @@
+// tests/hub_community_page.mjs — the hub's community pages (task 1003363; ADR 0217 D1,
+// ADR 0337 D1/D3/D4.1, docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8).
+//
+// One file served as three sub-pages of the bar's Community menu (owner, 2026-10-27):
+// /community the leaderboard, /community/find the builder search, /community/recruiters
+// the name-only list of hidden builders open to recruiters. They render three existing
+// platform-identity reads and add no rule of their own. What this file pins:
+//   • the markup: the hub's bar with the Community menu as the current section, no top
+//     block, noindex, dark only, the routes' own windows and query limits
+//   • viewing is ungated: the leaderboard and the search read the same routes for every
+//     viewer, and nothing on them asks who is signed in
+//   • the page RUN in a vm, once per sub-page: the path picks the section and the menu
+//     item marked current; the board in the server's order with its `place`, the window
+//     dropdown and the crafts, the empty, failed and rate-limited board; the search and
+//     its refusals; the recruiter list as a door signed out, a refusal on a 403, and rows
+//     only from a 200 — name, face and login, never the ranked half's numbers
+//   • the Community menu on every page that wears the hub's bar (apex-only where the page
+//     also serves a child), folded into the Projects band on phones
+//   • the routes: the three paths served on the hub's apex only
+//   • the kit: the states files, and the stub answering as the three reads do
+//
+// DB-free. Run:  node --test tests/hub_community_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const PI = path.join(ROOT, 'modules', 'platform-identity');
+const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8').replace(/\r\n/g, '\n');
+const PAGE = read('community.html');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+// the code alone: the comments name what they rule out
+const CODE = SCRIPT.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*?\*\//g, '');
+const MAIN = PAGE.split('<main class="acct" id="comm">')[1].split('</main>')[0];
+const BOARD_JS = fs.readFileSync(path.join(PI, 'community-leaderboard.js'), 'utf8');
+const SEARCH_JS = fs.readFileSync(path.join(PI, 'builder-search.js'), 'utf8');
+const SUBPAGES = [['/community', 'Leaderboard'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+
+// ── 1. the markup ────────────────────────────────────────────────────────────
+
+test('the pages wear the hub’s bar with the Community menu as the current section; dark only, no page :root, not indexed', () => {
+  assert.match(PAGE, /<html lang="en" data-mode="dark">/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/, 'public, but kept out of search until the SEO goal decides (owner, 2026-10-27)');
+  assert.match(PAGE, /<title>\{\{productName\}\} — Community<\/title>/);
+  assert.match(PAGE, /<link rel="stylesheet" href="\/assets\/cosmos\.css">/);
+  assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>/);
+  assert.match(PAGE, /<script src="\/assets\/invite-badge\.js"><\/script>/);
+  assert.doesNotMatch(STYLE, /:root/, 'the pack’s injected theme owns the tokens');
+  assert.doesNotMatch(STYLE, /#[0-9a-fA-F]{3,8}\b/, 'every colour is a token or a mix of one');
+  assert.match(PAGE, /<button class="trig commTrig" type="button" id="commTrig" data-menu="community" aria-expanded="false" aria-controls="menuCommunity" aria-current="true">Community<svg class="cv"/);
+  assert.deepEqual(PAGE.match(/aria-current="page"/g), null, 'which sub-page is current is the script’s, from the path');
+  assert.match(PAGE, /<a class="skip vh" href="#comm">Skip to content<\/a>/);
+  assert.equal((PAGE.match(/<!--apex-only:start-->/g) || []).length, 1, 'hub-only: the footer’s platform sentence is the one apex-only region');
+  assert.ok(PAGE.indexOf('<!--apex-only:start-->') > PAGE.indexOf('<footer class="foot">'));
+});
+
+test('the bar and bands are /connections’ but for the sign-in return and the current section', () => {
+  const bar = (html) => html.slice(html.indexOf('<header class="shell bar">'), html.indexOf('<main '))
+    .replace(/return=\/\w+&amp;/g, 'return=X&amp;').replace(/ aria-current="(page|true)"/g, '');
+  assert.equal(bar(PAGE), bar(read('connections.html')));
+});
+
+test('no top block: one visually hidden h1, then one section per sub-page, only the leaderboard shown in the markup', () => {
+  assert.match(MAIN, /^\s*<h1 class="vh">Community<\/h1>\s*(<!--[\s\S]*?-->\s*)?<div class="mineExtra">/, 'nothing is drawn above the first section (the /design floor)');
+  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
+  assert.ok(order.every((i) => i > 0), 'every sub-page is real markup the script only shows');
+  assert.deepEqual([...order].sort((a, b) => a - b), order);
+  assert.match(MAIN, /<ol class="commRows" id="boardList" data-unit="\{\{currency\}\}" aria-labelledby="boardH"><\/ol>/, 'the unit is the instance’s own word, stamped by the server');
+  assert.match(MAIN, /<p class="projMsg err" id="boardFailed" role="alert" hidden><\/p>/);
+  assert.match(MAIN, /<form class="mineJoinRow commFind" id="findForm" role="search"/);
+  assert.match(MAIN, /<h2 id="recruitH">Open to recruiters<\/h2>/, 'the hide flag is "hidden", never "private" (ADR 0337)');
+  assert.match(MAIN, /<a class="btn" id="recruitSignin" href="\/api\/bongos\/auth\/web\/start\?return=\/community\/recruiters&amp;repos=1">/);
+  for (const id of ['recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+});
+
+test('the window dropdown and the query limits are the routes’ own (boundary-forced copies)', () => {
+  const days = BOARD_JS.match(/const WINDOW_DAYS = Object\.freeze\(\{([^}]*)\}\);/);
+  const windows = [...days[1].matchAll(/'?(\w+)'?:/g)].map((m) => m[1]);
+  assert.deepEqual(windows, ['7d', '30d', '365d', 'all']);
+  assert.match(SCRIPT, new RegExp(`var WINDOWS = \\[${windows.map((w) => `'${w}'`).join(', ')}\\];`));
+  const select = MAIN.split('<select id="boardWindow">')[1].split('</select>')[0];
+  assert.deepEqual([...select.matchAll(/<option value="([^"]+)"/g)].map((m) => m[1]), windows, 'one option per window, in the route’s order');
+  assert.match(BOARD_JS, /const DEFAULT_WINDOW = 'all';/);
+  assert.match(select, /<option value="all" selected>All time<\/option>/, 'the page opens on the route’s default window');
+  assert.match(MAIN, /<label class="vh" for="boardWindow">/, 'the dropdown is labelled');
+  const min = SEARCH_JS.match(/const MIN_QUERY_CHARS = (\d+);/)[1];
+  const max = SEARCH_JS.match(/const MAX_QUERY_CHARS = (\d+);/)[1];
+  assert.match(SCRIPT, new RegExp(`var QUERY_MIN = ${min};`));
+  assert.match(SCRIPT, new RegExp(`var QUERY_MAX = ${max};`));
+  assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
+});
+
+test('the script builds no markup from strings, reads only the three routes, and never re-ranks or reads the ranked tier', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
+  // every path literal in the code: the API base, the three reads, the three sub-pages and the sign-in door
+  const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/scouting']);
+  assert.doesNotMatch(CODE, /method:/, 'it only reads');
+  assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
+  assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
+  assert.doesNotMatch(CODE, /\.builders\b|total_credits|total_tasks_shipped|project_count/, 'the directory’s ranked half is never drawn here');
+  assert.doesNotMatch(CODE, /\brank\b/, '`place` is a position on the board, never a builder rank');
+});
+
+// ── 2. the pages, run ────────────────────────────────────────────────────────
+
+function attrsOf(tag) {
+  const out = {};
+  for (const m of tag.matchAll(/ ([\w-]+)(?:="([^"]*)")?/g)) out[m[1]] = m[2] === undefined ? '' : m[2];
+  return out;
+}
+function el(tag, attrs = {}) {
+  const n = { tag, children: [], _text: '', className: attrs.class || '', hidden: 'hidden' in attrs, disabled: false, value: attrs.value || '', attrs: { ...attrs }, _on: {}, parent: null };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.getAttribute = (k) => (k in n.attrs ? n.attrs[k] : null);
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.querySelectorAll = (sel) => (sel === '.commTab' ? n.children.filter((c) => /\bcommTab\b/.test(c.className)) : []);
+  n.closest = (sel) => { const a = (sel.match(/^\[([\w-]+)\]$/) || [])[1]; return a && a in n.attrs ? n : null; };
+  return n;
+}
+const settle = async () => { for (let i = 0; i < 60; i++) await Promise.resolve(); };
+const kids = (n) => n.children;
+const find = (n, cls) => {
+  for (const c of n.children) {
+    if (String(c.className).split(' ').includes(cls)) return c;
+    const d = find(c, cls);
+    if (d) return d;
+  }
+  return null;
+};
+
+const ROW = (place, handle, credits, extra = {}) => ({ place, handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: `https://avatars.example/${handle}`, credits, tasks_shipped: 2, karma: 1, disciplines: ['engineer'], ...extra });
+const READS = () => ({
+  '/community/leaderboard?window=all': { status: 200, body: { window: 'all', count: 99, results: [ROW(26, 'ana', 1200), ROW(27, 'bo', 1500, { tasks_shipped: 1, karma: 0, avatar_url: 'javascript:alert(1)', display_name: null })] } },
+  '/community/leaderboard?window=30d': { status: 200, body: { window: '30d', results: [ROW(1, 'cy', 40)] } },
+  '/community/leaderboard?window=all&discipline=artist': { status: 200, body: { window: 'all', results: [] } },
+  '/community/search?q=pri': { status: 200, body: { results: [{ handle: 'priya', github_login: 'priyan', display_name: 'Priya', avatar_url: null, disciplines: ['engineer', 'ui'] }, { handle: 'pri-hidden', github_login: 'ph', display_name: 'Pri <b>H</b>', avatar_url: null, disciplines: null }] } },
+  '/community/search?q=pri&discipline=artist': { status: 200, body: { results: [] } },
+  '/scouting': { status: 403, body: { error: { code: 'forbidden' } } },
+});
+
+async function boot({ pathname = '/community', me = null, reads = READS() } = {}) {
+  const ids = new Map();
+  for (const m of PAGE.matchAll(/<(\w+)([^>]* id="([^"]+)"[^>]*)>/g)) {
+    const attrs = attrsOf(m[2]);
+    if (attrs['data-unit']) attrs['data-unit'] = 'credits';
+    const n = el(m[1], attrs);
+    n.id = m[3];
+    if (m[1] === 'select') n.value = (PAGE.split(m[0])[1].split('</select>')[0].match(/<option value="([^"]*)" selected>/) || [, ''])[1];
+    ids.set(m[3], n);
+  }
+  const body = PAGE.split('id="craftTabs"')[1].split('</div>')[0];
+  for (const b of body.matchAll(/<button([^>]*)>([^<]+)<\/button>/g)) { const n = el('button', attrsOf(b[1])); n.textContent = b[2]; ids.get('craftTabs').appendChild(n); }
+  // every menu link, so the script can mark the sub-page's items current
+  const anchors = [...PAGE.matchAll(/<a class="bandT" href="([^"]+)"[^>]*>([^<]+)<\/a>/g)].map((m) => { const n = el('a', { href: m[1] }); n.textContent = m[2]; return n; });
+  const requests = [];
+  const fetch = (url, init = {}) => {
+    requests.push({ url, credentials: init.credentials });
+    const a = reads[url.replace(/^\/api\/bongos/, '')];
+    if (!a || a.reject) return Promise.reject(new Error('offline'));
+    return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => Promise.resolve(a.body) });
+  };
+  const document = {
+    title: 'Cloud Bongos — Community',
+    getElementById: (id) => ids.get(id) || null,
+    createElement: (t) => el(t),
+    querySelectorAll: (sel) => { const h = (sel.match(/^a\[href="([^"]+)"\]$/) || [])[1]; return anchors.filter((a) => a.attrs.href === h); },
+  };
+  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) }, location: { pathname } };
+  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, Number, isFinite, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(SCRIPT, sandbox, { filename: 'community.html' });
+  await settle();
+  const tab = (value) => kids(ids.get('craftTabs')).find((b) => b.attrs['data-craft'] === value);
+  const craft = async (value) => { for (const f of ids.get('craftTabs')._on.click || []) f({ target: tab(value) }); await settle(); };
+  const pick = async (value) => { ids.get('boardWindow').value = value; for (const f of ids.get('boardWindow')._on.change || []) f({}); await settle(); };
+  const submit = async () => { const e = { preventDefault() { e.prevented = true; } }; for (const f of ids.get('findForm')._on.submit || []) f(e); await settle(); return e; };
+  const current = () => anchors.filter((a) => a.attrs['aria-current'] === 'page').map((a) => a.attrs.href);
+  return { ids, requests, document, gets: () => requests.map((r) => r.url), tab, craft, pick, submit, current, $: (id) => ids.get(id) };
+}
+
+test('each path shows its one section, marks its menu items current and names itself; any other shape is the leaderboard', async () => {
+  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
+    const ui = await boot({ pathname });
+    assert.deepEqual(['board', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
+    const href = SUBPAGES.find(([, t]) => t === title)[0];
+    assert.deepEqual(ui.current(), [href, href], `${pathname}: its Community item and its folded twin in the Projects band`);
+    assert.equal(ui.document.title, `Cloud Bongos — Community · ${title}`);
+    assert.equal(ui.$('signinTop').attrs.href, `/api/bongos/auth/web/start?return=${href}&repos=1`, 'signing in comes back to this sub-page');
+  }
+});
+
+test('the leaderboard, signed out: the all-time board in the server’s order with the server’s places, and nothing asked about the viewer', async () => {
+  const ui = await boot();
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all']);
+  assert.ok(ui.requests.every((r) => r.credentials === 'same-origin'));
+  assert.equal(ui.$('boardLoading').hidden, true);
+  assert.equal(ui.$('boardFailed').hidden, true);
+  assert.equal(ui.$('boardEmpty').hidden, true);
+  const [ana, bo] = kids(ui.$('boardList'));
+  assert.deepEqual([find(ana, 'commPlace').textContent, find(bo, 'commPlace').textContent], ['26', '27'], 'the place is the server’s, never renumbered');
+  assert.equal(find(ana, 'mineRow__name').textContent, 'ANA');
+  assert.equal(find(ana, 'mineRow__host').textContent, '@ana');
+  assert.equal(find(ana, 'commNum').textContent, (1200).toLocaleString());
+  assert.equal(find(ana, 'commUnit').textContent, 'credits');
+  assert.equal(find(ana, 'mineRow__hint').textContent, '2 works shipped · 1 karma');
+  assert.equal(find(bo, 'commNum').textContent, (1500).toLocaleString(), 'a higher number below stays below: the server ranked it');
+  assert.equal(find(bo, 'mineRow__name').textContent, 'bo', 'no display name: the handle stands in');
+  assert.equal(find(bo, 'connAv').tag, 'span', 'an avatar that is not http(s) is never loaded');
+  assert.equal(find(bo, 'mineRow__hint').textContent, '1 work shipped · 0 karma');
+  assert.equal(ui.$('boardNote').textContent, 'Credits earned across every project, since each builder started.');
+  const signedIn = await boot({ me: { github_login: 'someone' } });
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed in, the same one read: viewing is ungated');
+});
+
+test('the window dropdown and a craft are each one read; the pressed craft follows the pick', async () => {
+  const ui = await boot();
+  await ui.pick('30d');
+  assert.equal(ui.gets().pop(), '/api/bongos/community/leaderboard?window=30d');
+  assert.equal(ui.$('boardWindow').value, '30d');
+  assert.equal(ui.$('boardNote').textContent, 'Credits earned in the last 30 days, across every project.');
+  assert.deepEqual(kids(ui.$('boardList')).map((r) => find(r, 'mineRow__host').textContent), ['@cy']);
+  const before = ui.requests.length;
+  await ui.pick('30d');
+  assert.equal(ui.requests.length, before, 'picking the window already shown reads nothing');
+  await ui.pick('1d');
+  assert.equal(ui.requests.length, before, 'a window the route does not know is never asked for');
+  await ui.pick('all');
+  await ui.craft('artist');
+  assert.equal(ui.gets().pop(), '/api/bongos/community/leaderboard?window=all&discipline=artist');
+  assert.equal(ui.tab('artist').attrs['aria-pressed'], 'true');
+  assert.equal(ui.tab('').attrs['aria-pressed'], 'false');
+  assert.equal(ui.$('boardEmpty').hidden, false);
+  assert.equal(ui.$('boardEmpty').textContent, 'No artists on the leaderboard yet.');
+  assert.equal(kids(ui.$('boardList')).length, 0);
+});
+
+test('a failed board is an alert, never an empty board; a rate limit says to wait', async () => {
+  const reads = READS();
+  reads['/community/leaderboard?window=all'] = { status: 500, body: {} };
+  const failed = await boot({ reads });
+  assert.equal(failed.$('boardFailed').hidden, false);
+  assert.equal(failed.$('boardFailed').textContent, 'The leaderboard could not be read. Reload the page to try again.');
+  assert.equal(failed.$('boardEmpty').hidden, true, 'a failure never reads as nobody on the board');
+  reads['/community/leaderboard?window=all'] = { status: 429, body: { error: { code: 'rate_limited' } } };
+  assert.match((await boot({ reads })).$('boardFailed').textContent, /^Too many requests from your network just now\./);
+  reads['/community/leaderboard?window=all'] = { reject: true };
+  assert.equal((await boot({ reads })).$('boardFailed').hidden, false, 'offline is a failure too');
+});
+
+test('find: nothing read on arrival; too short is refused before any read; a hidden builder is found by name with no craft line', async () => {
+  const ui = await boot({ pathname: '/community/find' });
+  assert.deepEqual(ui.requests, [], 'the search page reads nothing until asked');
+  ui.$('findQ').value = ' p ';
+  const e = await ui.submit();
+  assert.ok(e.prevented, 'the form never navigates');
+  assert.deepEqual(ui.requests, []);
+  assert.equal(ui.$('findStatus').textContent, 'Type at least 2 letters of a name.');
+  ui.$('findQ').value = 'pri';
+  await ui.submit();
+  assert.equal(ui.gets().pop(), '/api/bongos/community/search?q=pri');
+  assert.equal(ui.$('findStatus').textContent, '2 builders found.');
+  const [priya, hidden] = kids(ui.$('findList'));
+  assert.equal(find(priya, 'mineRow__hint').textContent, 'engineer · designer');
+  assert.equal(find(hidden, 'mineRow__name').textContent, 'Pri <b>H</b>', 'textContent: a name is never markup');
+  assert.equal(find(hidden, 'mineRow__hint'), null, 'disciplines null (hidden numbers): nothing said about their craft');
+  assert.equal(ui.$('findBtn').disabled, false);
+  ui.$('findCraft').value = 'artist';
+  await ui.submit();
+  assert.equal(ui.gets().pop(), '/api/bongos/community/search?q=pri&discipline=artist');
+  assert.equal(ui.$('findStatus').textContent, 'No builder by that name in that role.');
+  assert.equal(kids(ui.$('findList')).length, 0);
+});
+
+test('recruiters: a door signed out, a refusal on a 403, rows only from a 200 as name, face and login', async () => {
+  const at = '/community/recruiters';
+  const shown = (ui) => ['recruitLoading', 'recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty'].filter((s) => !ui.$(s).hidden);
+  const out = await boot({ pathname: at });
+  assert.deepEqual(out.requests, [], 'signed out, the door is not even asked');
+  assert.deepEqual(shown(out), ['recruitDoor']);
+  const refused = await boot({ pathname: at, me: { github_login: 'someone' } });
+  assert.deepEqual(refused.gets(), ['/api/bongos/scouting'], 'signed in: the route’s door decides, and the board is not read here');
+  assert.deepEqual(shown(refused), ['recruitClosed'], 'a viewer the door does not admit is told it is for project owners');
+  assert.equal(kids(refused.$('recruitList')).length, 0);
+  const reads = READS();
+  reads['/scouting'] = { status: 200, body: {
+    builders: [{ github_id: '9', github_login: 'ranked', display_name: 'Ranked One', total_credits: 777777, total_tasks_shipped: 4242 }],
+    name_only: [{ github_login: 'kemi-a', display_name: 'Kemi', avatar_url: 'https://avatars.example/k' }, { github_login: 'yuki-t', display_name: null, avatar_url: null }],
+  } };
+  const admitted = await boot({ pathname: at, me: { github_login: 'owner' }, reads });
+  assert.deepEqual(shown(admitted), []);
+  const [kemi, yuki] = kids(admitted.$('recruitList'));
+  assert.equal(find(kemi, 'mineRow__name').textContent, 'Kemi');
+  assert.equal(find(kemi, 'mineRow__host').textContent, 'GitHub: kemi-a');
+  assert.equal(find(yuki, 'mineRow__name').textContent, 'yuki-t');
+  assert.equal(find(kemi, 'mineRow__hint'), null, 'no numbers, no crafts: the name-only tier is a name');
+  assert.doesNotMatch(admitted.$('recruitList').textContent, /Ranked One|777|4242/, 'the ranked half is never drawn');
+  reads['/scouting'] = { status: 200, body: { builders: [], name_only: [] } };
+  assert.deepEqual(shown(await boot({ pathname: at, me: { github_login: 'owner' }, reads })), ['recruitEmpty']);
+  reads['/scouting'] = { status: 401, body: {} };
+  assert.deepEqual(shown(await boot({ pathname: at, me: { github_login: 'stale' }, reads })), ['recruitDoor'], 'an expired session is a door');
+  reads['/scouting'] = { status: 500, body: {} };
+  const failed = await boot({ pathname: at, me: { github_login: 'owner' }, reads });
+  assert.deepEqual(shown(failed), ['recruitFailed']);
+  assert.equal(failed.$('recruitFailed').textContent, 'This list could not be read. Reload the page to try again.');
+});
+
+// ── 3. every bar carries the Community menu ──────────────────────────────────
+
+const SERVES_A_CHILD = ['privacy.html', 'terms.html', 'contact.html', 'index.html', 'projects.html'];
+const HUB_ONLY = ['account.html', 'connections.html', 'invitations.html', 'guild.html', 'community.html'];
+const wrap = (apex, s) => (apex ? `<!--apex-only:start-->${s}<!--apex-only:end-->` : s);
+const ITEMS = [
+  ['/community', 'Leaderboard', 'who earned the most, across every project'],
+  ['/community/find', 'Find a builder', 'anyone building here, by name or role'],
+  ['/community/recruiters', 'Open to recruiters', 'who is open to recruiting, for project owners'],
+];
+// signed in only, and it opens /connections' own panel rather than a second one here (task 1004256)
+const KNOW = '<a class="bandT" href="/connections#connSuggest">Builders you may know</a><span class="bandC">connections or projects in common</span></li>';
+
+test('every page that wears the hub’s bar carries the Community menu before Projects; apex-only where the page serves a child', () => {
+  const { stripApexOnly } = require('../src/platform-server.js');
+  const trig = '<button class="trig commTrig" type="button" id="commTrig" data-menu="community" aria-expanded="false" aria-controls="menuCommunity"';
+  const band = ['<div class="menuBand" id="menuCommunity" data-menu="community" hidden>', '  <div class="bandIn">', '    <ul class="bandRow">',
+    ...ITEMS.map(([h, t, c]) => `      <li class="bandCell"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`),
+    `      <li class="bandCell knowCell" hidden>${KNOW}`, '    </ul>', '  </div>', '</div>'].join('\n');
+  const fold = ITEMS.map(([h, t, c]) => `<li class="bandCell bandFold"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`).join('')
+    + `<li class="bandCell bandFold knowCell" hidden>${KNOW}`;
+  for (const f of [...SERVES_A_CHILD, ...HUB_ONLY]) {
+    const html = read(f);
+    const apex = SERVES_A_CHILD.includes(f);
+    const at = html.indexOf(apex ? `<!--apex-only:start-->${trig}` : trig);
+    assert.ok(at > 0, `${f}: the Community trigger`);
+    assert.ok(html.indexOf('id="projTrig"') > at, `${f}: Community comes before Projects`);
+    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its three sub-pages`);
+    assert.ok(html.indexOf('id="menuCommunity"') < html.indexOf('id="menuProjects"'), `${f}: the bands in the bar’s order`);
+    assert.ok(html.includes(wrap(apex, fold)), `${f}: the three folded into the Projects band for phones`);
+    if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity|connSuggest/, `${f}: a child has no community pages, so no trace of the menu`);
+  }
+});
+
+test('Builders you may know: shown only once GET /me names someone, and drawn once, on /connections', () => {
+  // every bar script that paints the signed-in state shows or hides both cells with it
+  assert.match(read('assets/hub-bar.js'), /\$\('mineCell'\)\.hidden = !me;\n\s*Array\.prototype\.forEach\.call\(document\.querySelectorAll\('\.knowCell'\), function \(c\) \{ c\.hidden = !me; \}\);/);
+  assert.match(read('projects.html'), /function paintShellIdentity\(\) \{[\s\S]*?document\.querySelectorAll\('\.knowCell'\)\.forEach\(function \(c\) \{ c\.hidden = !signedIn; \}\);/);
+  assert.match(read('index.html'), /if \(mine\) mine\.hidden = false;\n\s*document\.querySelectorAll\('\.knowCell'\)\.forEach\(function \(c\) \{ c\.hidden = false; \}\);/);
+  // the panel it opens exists, and the community page reads no suggestions of its own
+  assert.match(read('connections.html'), /<section id="connSuggest" aria-labelledby="connSuggestH" hidden>/);
+  assert.doesNotMatch(read('community.html').split('<script>')[1], /connections\/suggestions/);
+});
+
+test('the menu folds into the Projects band under 480px on the hub and 900px on the landing; the arrows skip what CSS does not draw', () => {
+  const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+  assert.match(css, /\.trig\[aria-expanded="true"\],\.trig\[aria-current="true"\]\{color:var\(--ink\);text-decoration:underline;/, 'on its own pages the menu reads as the current section');
+  assert.match(css, /\n\.bandFold\{display:none;\}\n/, 'above 480 the Projects band does not repeat the menu');
+  assert.match(css.split('@media (max-width:480px){')[1].split('\n}')[0], /\.commTrig\{display:none;\}\s*\.bandFold\{display:block;\}/);
+  const index = read('index.html');
+  assert.match(index, /\n\.bandFold\{display:none\}\n/);
+  // a hidden fold cell (signed in only, task 1004256) must stay down where the fold shows:
+  // cosmos.css's [hidden] rule is !important; the landing has none, so it carries its own
+  assert.match(css, /\n\[hidden\]\{display:none !important;\}\n/);
+  assert.match(index, /\n\.bandFold\[hidden\]\{display:none\}\n/);
+  assert.match(index.split('@media (max-width:900px){')[1], /^[\s\S]*?\.commTrig\{display:none\}\s*\.bandFold\{display:block\}/);
+  for (const f of ['assets/hub-bar.js', 'projects.html', 'index.html']) {
+    assert.match(read(f), /return !a\.closest\('\[hidden\]'\) && a\.offsetParent !== null; \}\);/, `${f}: the arrows skip a cell CSS does not draw`);
+  }
+  assert.doesNotMatch(css + index, /\.barLink/, 'the plain link this menu replaced is gone');
+});
+
+// ── 4. the routes ────────────────────────────────────────────────────────────
+
+const { buildPlatformApp } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /community, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  for (const [p] of SUBPAGES) assert.equal((await get(p, 'game.test.local')).status, 404, `${p}: a child instance has none of the routes these pages read`);
+  modules.setModuleOverrides({ 'platform-identity': true });
+  const bodies = [];
+  for (const [p] of SUBPAGES) {
+    const hub = await get(p, 'game.test.local');
+    assert.equal(hub.status, 200, p);
+    assert.match(hub.body, /— Community<\/title>/);
+    assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/, 'every token stamped, the unit word included');
+    bodies.push(hub.body);
+  }
+  assert.ok(bodies.every((b) => b === bodies[0]), 'byte-identical for every sub-page: the script picks the view');
+  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the three sub-pages');
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    assert.doesNotMatch((await get('/community', host)).body, /— Community<\/title>/, `${host} must not serve /community`);
+  }
+});
+
+// ── 5. the kit ───────────────────────────────────────────────────────────────
+
+test('the kit renders each sub-page for everyone, the empty board, and a project owner’s recruiter list', () => {
+  const json = (f) => JSON.parse(read(f));
+  const states = json('community.states.json');
+  assert.equal(states.page, '/community');
+  assert.deepEqual(states.modes, ['dark']);
+  for (const s of ['out', 'out-30d', 'out-artists', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
+  assert.equal(states.states['out-find'].url, '/community/find');
+  assert.equal(states.states['in-recruiters'].url, '/community/recruiters');
+  assert.ok(states.states['in-recruiters'].expect.visible.includes('#recruitClosed'), 'signed in but not admitted: told, shown no one');
+  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter']]) {
+    assert.equal(json(file).stub.fixtures[name], fixture);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
+  }
+  assert.equal(json('community-recruiter.states.json').states['in-recruiter'].url, '/community/recruiters');
+});
+
+function stub(env = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js')], {
+      env: { ...process.env, STUB_PORT: '0', ...env }, stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    let out = '';
+    child.stdout.on('data', (c) => {
+      out += c;
+      const m = out.match(/stub on (http:\/\/127\.0\.0\.1:\d+)\//);
+      if (m) resolve({ origin: m[1], stop: () => child.kill() });
+    });
+    child.on('exit', (code) => reject(new Error(`stub exited ${code}: ${out}`)));
+  });
+}
+async function call(origin, p) {
+  const res = await globalThis.fetch(origin + '/api/bongos' + p);
+  return { status: res.status, body: await res.json() };
+}
+
+test('the kit stub answers the board, the search and the recruiting door the way the routes do', async () => {
+  const s = await stub();
+  try {
+    const all = await call(s.origin, '/community/leaderboard');
+    assert.equal(all.body.window, 'all');
+    assert.deepEqual(all.body.results.map((r) => r.place), all.body.results.map((_, i) => i + 1));
+    assert.equal(all.body.count, all.body.results.length);
+    const artists = await call(s.origin, '/community/leaderboard?window=all&discipline=artist');
+    assert.ok(artists.body.results.length && artists.body.results.every((r) => r.disciplines.includes('artist')));
+    assert.equal(artists.body.results[0].place, 1, 'a filtered board is numbered on its own');
+    assert.equal((await call(s.origin, '/community/leaderboard?window=1d')).body.error.code, 'bad_window');
+    assert.equal((await call(s.origin, '/community/search?q=p')).body.error.code, 'query_too_short');
+    const byName = await call(s.origin, '/community/search?q=sam');
+    assert.deepEqual(byName.body.results.map((r) => [r.handle, r.disciplines]), [['sam-rivera', null]], 'a hidden builder is found by name');
+    assert.equal((await call(s.origin, '/community/search?q=sam&discipline=engineer')).body.results.length, 0, 'and drops out of a craft search');
+    assert.equal((await call(s.origin, '/scouting')).status, 401, 'signed out, the door answers 401');
+  } finally { s.stop(); }
+  const member = await stub({ AUTH: '1' });
+  try {
+    assert.equal((await call(member.origin, '/scouting')).status, 403, 'signed in, most builders are refused');
+  } finally { member.stop(); }
+  const owner = await stub({ AUTH: '1', FIXTURE_ALIAS: JSON.stringify({ scouting: 'scouting-recruiter' }) });
+  try {
+    const r = await call(owner.origin, '/scouting');
+    assert.equal(r.status, 200);
+    assert.ok(r.body.name_only.every((n) => Object.keys(n).sort().join() === 'avatar_url,display_name,github_login'), 'the name-only tier is three columns');
+  } finally { owner.stop(); }
+});

package/tests/hub_connections_page.mjs

@@ -128,6 +128,7 @@ function el(tag) {
   n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
   n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
   n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.scrollIntoView = () => { n.scrolled = (n.scrolled || 0) + 1; };
   return n;
 }
 const settle = async () => { for (let i = 0; i < 60; i++) await Promise.resolve(); };
@@ -161,7 +162,7 @@ const GRAPH = () => ({
   ], count: 2 } },
 });
 
-async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRAPH(), writes = [] } = {}) {
+async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRAPH(), writes = [], hash = '' } = {}) {
   const ids = new Map();
   for (const id of [...PAGE.matchAll(/ id="([^"]+)"/g)].map((m) => m[1])) {
     const n = el('x');
@@ -180,15 +181,18 @@ async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRA
     return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => (a.body === undefined ? Promise.reject(new SyntaxError('no body')) : Promise.resolve(a.body)) });
   };
   const document = { getElementById: (id) => ids.get(id) || null, createElement: el };
-  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) } };
-  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, Date, isNaN, encodeURIComponent };
+  const winOn = {};
+  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) }, addEventListener: (t, f) => { (winOn[t] ||= []).push(f); } };
+  const location = { hash };
+  const sandbox = { window, document, fetch, location, console, Promise, JSON, String, Object, Array, URL, Date, isNaN, encodeURIComponent };
   vm.createContext(sandbox);
   vm.runInContext(SCRIPT, sandbox, { filename: 'connections.html' });
   await settle();
   const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
   const key = async (n, k) => { const e = { key: k, preventDefault() { e.prevented = true; } }; for (const f of n._on.keydown || []) f(e); await settle(); return e; };
   const gets = () => requests.filter((r) => r.method === 'GET').map((r) => r.url);
-  return { ids, requests, gets, click, key, $: (id) => ids.get(id) };
+  const hashTo = async (h) => { location.hash = h; for (const f of winOn.hashchange || []) f({}); await settle(); };
+  return { ids, requests, gets, click, key, hashTo, $: (id) => ids.get(id) };
 }
 const button = (row, label) => all(row, 'btn').find((b) => b.textContent === label);
 
@@ -283,6 +287,51 @@ test('a failed suggestions read drops only that panel', async () => {
   assert.equal(kids(ui.$('connList')).length, 2);
 });
 
+test('opened by the Community menu’s item (#connSuggest): scrolled to once, and an empty panel says so', async () => {
+  // the panel draws after the browser's own jump to the fragment, so the page makes it, once
+  let ui = await boot({ hash: '#connSuggest', writes: [{ status: 201, body: { status: 'pending' } }] });
+  assert.equal(ui.$('connSuggest').hidden, false);
+  assert.equal(ui.$('suggestNone').hidden, true, 'suggestions need no explaining');
+  assert.equal(ui.$('connSuggest').scrolled, 1);
+  await ui.click(button(kids(ui.$('suggestList'))[0], 'Connect'));
+  assert.equal(ui.gets().length, 6);
+  assert.equal(ui.$('connSuggest').scrolled, 1, 'a re-read after Connect does not jump the page again');
+
+  const none = GRAPH();
+  none['/connections/suggestions'].body = { suggestions: [] };
+  ui = await boot({ hash: '#connSuggest', reads: none });
+  assert.equal(ui.$('connSuggest').hidden, false, 'asked for by name, the panel answers rather than vanishing');
+  assert.equal(ui.$('suggestNone').hidden, false);
+  assert.match(PAGE, /<p class="mineEmpty" id="suggestNone" hidden>No one to suggest yet\. Suggestions come from the connections and projects you have in common with other builders\.<\/p>/);
+
+  const failed = GRAPH();
+  failed['/connections/suggestions'] = { status: 500, body: {} };
+  ui = await boot({ hash: '#connSuggest', reads: failed });
+  assert.equal(ui.$('connSuggest').hidden, true, 'an unread list is not "no one to suggest"');
+  assert.equal(ui.$('connSuggest').scrolled, undefined);
+});
+
+test('the menu item pressed while already on the page: the hash change is answered as an arrival', async () => {
+  const none = GRAPH();
+  none['/connections/suggestions'].body = { suggestions: [] };
+  let ui = await boot({ reads: none });
+  assert.equal(ui.$('connSuggest').hidden, true, 'a plain visit: no suggestions, no empty shell');
+  await ui.hashTo('#connSuggest');
+  assert.equal(ui.gets().length, 6, 'one re-read');
+  assert.equal(ui.$('connSuggest').hidden, false);
+  assert.equal(ui.$('suggestNone').hidden, false);
+
+  ui = await boot();
+  await ui.hashTo('#connSuggest');
+  assert.equal(ui.$('connSuggest').scrolled, 1, 'scrolled to once the panel is drawn');
+  await ui.hashTo('#connList');
+  assert.equal(ui.gets().length, 6, 'any other hash reads nothing');
+
+  ui = await boot({ me: null });
+  await ui.hashTo('#connSuggest');
+  assert.deepEqual(ui.requests, [], 'signed out, the door stands and nothing is read');
+});
+
 test('Accept, Decline, Remove and Withdraw: one call each, then the page re-reads', async () => {
   const cases = [
     ['incomingList', 'Accept', 'POST', '/api/bongos/connections/51/accept', { status: 200, body: { status: 'accepted' } }, 'Connected.'],

package/tests/hub_guild_page.mjs

@@ -216,6 +216,7 @@ function boot({ pathname = '/g/forge-crew', me = null, answer = () => NOT_FOUND,
     querySelectorAll(sel) {
       if (sel === '.trig') return trigs;
       if (sel === '.menuBand') return bands;
+      if (sel === '.knowCell') return [];
       const m = sel.match(/^input\[name="(\w+)"\]$/);
       if (!m) throw new Error(`unstubbed selector: ${sel}`);
       return radios.filter((r) => r.name === m[1]);