@bongos/core 1.24.64 → 1.24.65

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.64",
-  "core_contract": "1.24.64",
-  "source_commit": "3ec2f53ca824f8f5ae9954733449d50e6d771d78",
+  "core_version": "1.24.65",
+  "core_contract": "1.24.65",
+  "source_commit": "8f67a76402acd252e7d9997710389225189f1ff7",
   "source_ref": "HEAD",
-  "built_at": "2026-11-08T11:46:13.511Z",
+  "built_at": "2026-11-08T19:44:15.057Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3902,
+    "functional_verbatim": 3904,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4573,
-  "tree_sha256": "05be327dd13c886de8623f745d2aafc5a44e53b1474621c1d66528fb88bbc306",
+  "file_count": 4575,
+  "tree_sha256": "de673fb6edbef391285acd5a1ba81d227ff869398df36e3c4d06940dddae3ac8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6f54bb50baf24667d580a0a1800893b4f274ec757b1766230ab2d99f80cf2e21"
+      "sha256": "a661073ecdafcaa6ead7089b09758c4e3072ed1fba467670904b5ce73de426c9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ebf93f1762d8c434f4be706a146234bc6047b37e2c1ebcca6c961da817a57b24"
+      "sha256": "b7ffb5c80ef9e08ddbe54c1e125fdbd2e92c2b864c1b2d320fcf83ba964c9cc2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f878eabd1e4556e46155b760462e8f433a1472ecc771fed5638011a401844af6"
+      "sha256": "482f515d87fb3ffc09c6971a26c5a7519551f6e0bd1816d0afd6c6cfb3e57448"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "c56e5afc1883d40326c974209ebfe30d603375a991532ae4775c55f1cda428df"
+      "sha256": "be73c388b331c7077a4564866c27f60912c513843ffebc4c94c31a19aeee954b"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -13177,7 +13177,7 @@
     {
       "path": "scripts/bongos/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "be2eb571965101b309308d73d2bea556ea7a9ff9550ec24542df61b904646d60"
+      "sha256": "85fc4fb8e3940c71b4f2eac604374b583bca16e6e590847d597cf9e59fbb44f7"
     },
     {
       "path": "scripts/bongos/runner-drift.js",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6937e1a1767458c2da6342b38b7631c63d87752688584ca9b5fa59cd94b9a026"
+      "sha256": "1f78ed60de37fa15b7f57e5c19acfc0fb9bcab021e6cbd3a2ecc2044f9d76518"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16974,6 +16974,11 @@
       "mode": "0000644",
       "sha256": "386bea21404a5921a450adf251bb9cb54694684941a5b3d3b000a266cc9d09f7"
     },
+    {
+      "path": "tests/community_proof_db.mjs",
+      "mode": "0000644",
+      "sha256": "a68d8274db242141006e661f3a5879efd769d1facc25fc5e2c362abe80a4084e"
+    },
     {
       "path": "tests/community_search_route.mjs",
       "mode": "0000644",
@@ -17769,6 +17774,11 @@
       "mode": "0000644",
       "sha256": "a86b984c420c260c5298b1fd15c48533a27a4ead3ad63543bdfa63ecd6b37949"
     },
+    {
+      "path": "tests/fixtures/privacy-matrix.mjs",
+      "mode": "0000644",
+      "sha256": "a540792ffd23206b4e37b9fca7b8498e55de853211f4714cad791af28029af9c"
+    },
     {
       "path": "tests/fixtures/seed-tasks/bongos-v1-idea-routing.json",
       "mode": "0000644",
@@ -20697,7 +20707,7 @@
     {
       "path": "tests/privacy_matrix.mjs",
       "mode": "0000644",
-      "sha256": "a2592ce72e24d6bb5acee360594ae48b3b6d23ad93467953b4745d3eb552cfd9"
+      "sha256": "7a9aea3dd6db1b8048b35cf64624553fa148a9cd03030fa336eb9453ba5068bb"
     },
     {
       "path": "tests/probe_cache.mjs",

package/docs/module-api-changelog.md

@@ -3382,5 +3382,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.62 with no explicit bump. run 42392141827. (task 1002620)
   1.24.64 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.63 with no explicit bump. run 42477114353. (task 1002620)
+  1.24.65 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.64 with no explicit bump. run 42516347052. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.64",
+  "version": "1.24.65",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.64",
+      "version": "1.24.65",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.64",
+  "version": "1.24.65",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11359,5 +11359,11 @@
       "id": "1005177",
       "text": "The next version is scoped. The builders' hall becomes a game you are inside rather than a website you navigate: three characters to play as, a city that grows as the project grows, and work claimed as quest chains instead of"
     }
+  ],
+  "1.24.65": [
+    {
+      "id": "1002985",
+      "text": "The community page now has one test proving, on a real database, that hidden, private and new accounts never show on any leaderboard, search, crown or mover card, and that every week, month and year total is exact."
+    }
   ]
 }

package/scripts/bongos/run-unit-tests.js

@@ -88,6 +88,10 @@ const INTEGRATION = new Set([
   // year's baseline over 30 days, a quiet row's live total, hidden and private left out.
   // The DB-free sibling is community_movers.
   'community_movers_db',
+  // task 1002985: the community proof — one fixture per privacy-matrix row and one snapshot
+  // history through every community route on real SQL. Its DB-free sibling is the
+  // privacy-matrix proof, which must stay unnamed here (it asserts that it is).
+  'community_proof_db',
   // task 1004936: the Market Watch tables, hub seed and read queries against real SQL. The
   // CHECKs, partial unique indexes and ON CONFLICT targets are what make the seed
   // idempotent and a resumed run unable to record an item twice. DB-free sibling:

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.65'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/community_proof_db.mjs

@@ -0,0 +1,334 @@
+// tests/community_proof_db.mjs — PROOF: the privacy matrix and the window math on every
+// community surface, against real Postgres (task 1002985, goal 1000110 CT9;
+// docs/specs/bongos-v1-community-tab.md D3, D4, D5, D7 and D8).
+//
+// WHAT THIS ADDS. tests/privacy_matrix.mjs proves every cell DB-free, through an
+// interpreter that reads each statement's WHERE text, and each surface's own _db test
+// proves its arithmetic on a fixture of its own. Neither runs ONE fixture through EVERY
+// surface on real SQL. This does: one account per D2 row with the cells of
+// tests/fixtures/privacy-matrix.mjs, one shared snapshot history, and the real routers
+// over HTTP — the leaderboard in every window, search by name and by craft, the builder
+// of the week, the crowns and the movers — each read signed out and signed in, and the
+// two bodies compared byte for byte.
+//
+// THE HISTORY. PUB's credits step up one hour after every window edge, by 1, 2, 4 … 256,
+// one work a step, so each window's total is a bitmask naming exactly the snapshots it
+// counted (510 = every step after the 365-day edge, 192 = the week's two). Every account
+// the matrix keeps off the boards gains 1000 a step: had any predicate let one through,
+// it would top that board and take that crown, so its absence is never vacuous.
+//
+// THE CLOCK is frozen at NOW, a Wednesday in August 2097, because the routes take no
+// `now`. Every read is global, and those windows hold no real builder's snapshot, so a
+// shared database's own rows move nowhere in them (the crowns and movers _db precedent).
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION
+// set (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/community_proof_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import http from 'node:http';
+import { strict as assert } from 'node:assert';
+import { KEYS, STATE, MATRIX } from './fixtures/privacy-matrix.mjs';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const express = require('express');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`community_proof_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// ---------------------------------------------------------------------------
+// The fixture
+// ---------------------------------------------------------------------------
+
+const PREFIX = 't1002985-';
+const TAG = 't1002985-craft'; // every fixture row's only craft; the board reads filter on it
+const ID = Object.fromEntries(KEYS.map((k, i) => [k, 90298501 + i]));
+// '-acct' keeps one handle from being a substring of another (priv / privd / privdh)
+const HANDLE = Object.fromEntries(KEYS.map((k) => [k, `${PREFIX}${k.toLowerCase()}-acct`]));
+const NAME = Object.fromEntries(KEYS.map((k) => [k, `T1002985 ${k} Acct`]));
+const IDS = Object.values(ID);
+const CLIENT = 't1002985-p1';
+const ORIGIN = 'https://t1002985-p1.example';
+const PROJECT = 'T1002985 Alpha';
+
+const NOW = '2097-08-14T12:00:00.000Z';
+const HISTORY = '2095-06-01T00:00:00.000Z'; // the first snapshot written: when history began
+// Every edge a surface reads, in time order. The routes' own answers are checked against
+// these below, so a fixture that stopped straddling them would fail, not pass vacuously.
+const EDGE = {
+  lastYear: '2096-01-01T00:00:00.000Z',
+  d365: '2096-08-14T12:00:00.000Z',
+  year: '2097-01-01T00:00:00.000Z',
+  month: '2097-07-01T00:00:00.000Z',
+  d30: '2097-07-15T12:00:00.000Z',
+  monthEnd: '2097-08-01T00:00:00.000Z',
+  week: '2097-08-05T00:00:00.000Z',
+  d7: '2097-08-07T12:00:00.000Z',
+  weekEnd: '2097-08-12T00:00:00.000Z',
+};
+const day = (iso) => iso.slice(0, 10);
+
+// PUB's numbers per window, read off its steps: the sum of the steps after the edge.
+const PUB_IN = {
+  all: [511, 9], // every step
+  '365d': [510, 8], // 2 … 256: the 365-day edge falls after the first step
+  '30d': [496, 5], // 16 … 256
+  '7d': [384, 2], // 128 + 256
+  week: [192, 2], // 64 + 128: the step after the week's end is the next week's
+  month: [24, 2], // 8 + 16: the step after the month's end is August's
+  year: [508, 7], // 4 … 256, the year so far
+  lastYear: [3, 2], // 1 + 2
+};
+// OPTOUT: 5 credits and one work at the 7-day edge plus two hours, so inside every rolling
+// window, the week and the year so far, and in neither July nor last year.
+const OPTOUT_IN = [5, 1];
+
+// The shared rule this history is built for: the boards, the crowns and the movers show
+// PUB and OPTOUT and nobody else (a crown or a card IS stats — the board's rule).
+const SHOWN = KEYS.filter((k) => MATRIX[k].board === 'listed');
+assert.deepEqual(SHOWN, ['PUB', 'OPTOUT'], 'the matrix changed — re-plan this history before trusting it');
+for (const k of KEYS) {
+  for (const col of ['week', 'crowns', 'movers']) assert.equal(MATRIX[k][col], MATRIX[k].board, `${k}.${col} no longer follows the board`);
+}
+const KEPT_OFF = KEYS.filter((k) => !SHOWN.includes(k));
+
+// ---------------------------------------------------------------------------
+// The frozen clock, the doorway and the real routers
+// ---------------------------------------------------------------------------
+
+// Every Date the modules make from here on is a FrozenDate. A Date made before the swap
+// would fail pg's `instanceof Date`, so fixture times go to SQL as ISO strings.
+const RealDate = Date;
+const clock = { now: RealDate.parse(NOW) };
+class FrozenDate extends RealDate {
+  constructor(...args) {
+    if (args.length) super(...args);
+    else super(clock.now);
+  }
+
+  static now() {
+    return clock.now;
+  }
+}
+globalThis.Date = FrozenDate;
+const after = (iso, hours) => new RealDate(RealDate.parse(iso) + hours * 3600 * 1000).toISOString();
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath,
+  filename: moduleApiPath,
+  loaded: true,
+  exports: {
+    pool,
+    corsPublicGet: () => (_req, _res, next) => next(),
+    logger: () => ({ error: (o, m) => console.error(`route error: ${m}`, o), info: () => {}, warn: () => {} }),
+  },
+};
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const f of ['community-search', 'community-leaderboard']) {
+  app.use('/api/bongos', require(`../modules/platform-identity/routes/${f}.js`)());
+}
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+const SIGNED_IN = { Authorization: 'Bearer t1002985-viewer', Cookie: 'bongos_session=t1002985-viewer' };
+const SEEN = []; // every body served, for the sweep at the end
+function get(path, headers) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path, headers, agent: false }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, text: Buffer.concat(chunks).toString('utf8') }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+// A surface read signed out and signed in: the same bytes to both (spec D3, D8).
+async function read(path) {
+  const anon = await get(path, {});
+  const signed = await get(path, SIGNED_IN);
+  assert.equal(anon.status, 200, `${path} → ${anon.status}: ${anon.text.slice(0, 300)}`);
+  assert.equal(signed.text, anon.text, `${path}: a signed-in viewer got a different body`);
+  SEEN.push({ path, text: anon.text });
+  return JSON.parse(anon.text);
+}
+
+const q = (sql, params) => pool.query(sql, params);
+let pass = 0;
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+const who = (w) => w && [w.handle, w.credits, w.tasks_shipped];
+const mine = (rows) => rows.filter((r) => r.handle.startsWith(PREFIX));
+
+async function cleanup() {
+  await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_projects WHERE origin = $1', [ORIGIN]).catch(() => {});
+  await q('DELETE FROM platform_identity_sso_clients WHERE client_id = $1', [CLIENT]).catch(() => {});
+  await q('DELETE FROM platform_identity_weekly_features WHERE week_start = $1::date', [day(EDGE.week)]).catch(() => {});
+  await q(
+    `DELETE FROM platform_identity_period_features
+      WHERE (period = 'month' AND period_start = $1::date) OR (period = 'year' AND period_start = $2::date)`,
+    [day(EDGE.month), day(EDGE.lastYear)],
+  ).catch(() => {});
+}
+
+// One (project, builder) row, seen since history began, and its cumulative snapshots.
+async function history(k, steps) {
+  const [, credits, ships] = steps[steps.length - 1];
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma, disciplines, first_seen_at)
+     VALUES ($1, $2, $3, $4, 0, $5, $6)`,
+    [CLIENT, ID[k], credits, ships, [TAG], HISTORY],
+  );
+  for (const [at, c, s] of steps) {
+    await q(
+      `INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at)
+       VALUES ($1, $2, $3, $4, 0, $5)`,
+      [CLIENT, ID[k], c, s, at],
+    );
+  }
+}
+// From zero at HISTORY, one step `hours` after each edge, `size(i)` credits and one work each.
+function stepsAfterEachEdge(hours, size) {
+  let credits = 0;
+  return [[HISTORY, 0, 0], ...Object.values(EDGE).map((edge, i) => {
+    credits += size(i);
+    return [after(edge, hours), credits, i + 1];
+  })];
+}
+
+try {
+  await q('CREATE EXTENSION IF NOT EXISTS pg_trgm');
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_004_projects.sql', 'platform_identity_005_builder_activity.sql',
+    'platform_identity_007_profile_consent.sql', 'platform_identity_008_handle.sql',
+    'platform_identity_011_project_visibility.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_019_terms_acceptance.sql', 'platform_identity_020_visibility_pull.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_023_builder_search_trgm.sql',
+    'platform_identity_032_weekly_features.sql', 'platform_identity_033_period_features.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  for (const k of KEYS) {
+    const s = STATE[k];
+    await q(
+      `INSERT INTO platform_identity_accounts
+         (github_id, github_login, display_name, handle, profile_state, account_visibility, hide_stats, recruiter_discoverable, terms_accepted_at)
+       VALUES ($1, $2, $3, $2, $4, $5, $6, $7, now())`,
+      [ID[k], HANDLE[k], NAME[k], s.profile_state, s.account_visibility, s.hide_stats, s.recruiter_discoverable],
+    );
+  }
+  await q(`INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin) VALUES ($1, 'x', $2, $3)`, [CLIENT, PROJECT, ORIGIN]);
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, description, featured, status, visibility, visibility_source)
+     VALUES ($1, $2, 'described', false, 'active', 'public', 'control-plane')`,
+    [ORIGIN, PROJECT],
+  );
+  await history('PUB', stepsAfterEachEdge(1, (i) => 2 ** i)); // first, so its HISTORY row is the first snapshot
+  await history('OPTOUT', [[HISTORY, 0, 0], [after(EDGE.d7, 2), ...OPTOUT_IN]]);
+  for (const k of KEPT_OFF) await history(k, stepsAfterEachEdge(2, () => 1000));
+
+  // 1 — The leaderboard in every window (D3): exactly the shown accounts, the numbers exact.
+  for (const [w, edge] of [['all', null], ['365d', EDGE.d365], ['30d', EDGE.d30], ['7d', EDGE.d7]]) {
+    const board = await read(`/api/bongos/community/leaderboard?window=${w}&discipline=${TAG}&limit=100`);
+    same(board.since, edge, `${w}: the window opens on the edge the history straddles`);
+    same(board.results.map((r) => [r.place, r.handle, r.credits, r.tasks_shipped]),
+      [[1, HANDLE.PUB, ...PUB_IN[w]], [2, HANDLE.OPTOUT, ...OPTOUT_IN]],
+      `${w} board: PUB ${PUB_IN[w][0]} and OPTOUT ${OPTOUT_IN[0]}; the five accounts kept off, each ahead of both, are absent`);
+  }
+
+  // 2 — Search (D4): findable by name per the matrix; a craft is stats, so the craft filter
+  // drops the hidden account the name search lists.
+  const byName = new Map(mine((await read(`/api/bongos/community/search?q=${PREFIX}&limit=50`)).results).map((r) => [r.handle, r]));
+  for (const k of KEYS) {
+    const r = byName.get(HANDLE[k]);
+    const got = !r ? 'absent' : r.disciplines === null ? 'name-only' : 'listed';
+    same(got, MATRIX[k].search, `search by name, ${STATE[k].label}: ${MATRIX[k].search}`);
+    if (got === 'listed') same(r.disciplines, [TAG], `${k}'s crafts are its own`);
+  }
+  const byCraft = mine((await read(`/api/bongos/community/search?q=${PREFIX}&discipline=${TAG}&limit=50`)).results);
+  same(byCraft.map((r) => r.handle).sort(), KEYS.filter((k) => MATRIX[k].search === 'listed').map((k) => HANDLE[k]).sort(),
+    'search by craft: the hidden account found by name is absent');
+
+  // 3 — The builder of the week (D5): the last full Monday-to-Monday week, crowned at render.
+  const bow = await read('/api/bongos/community/builder-of-the-week');
+  same([bow.week.start, bow.week.end], [day(EDGE.week), day(EDGE.weekEnd)], 'the crowned week is the one the history straddles');
+  same(who(bow.winner), [HANDLE.PUB, ...PUB_IN.week], 'builder of the week: PUB’s 192 and two works');
+  same(mine(bow.past), [], 'no fixture account in the past weeks');
+
+  // 4 — The crowns: the month and last year crowned at render, the year so far live.
+  const crowns = await read('/api/bongos/community/crowns');
+  same(who(crowns.week.winner), [HANDLE.PUB, ...PUB_IN.week], 'the home’s week is the same crown');
+  same([crowns.month.start, crowns.month.end, crowns.month.first_crown], [day(EDGE.month), day(EDGE.monthEnd), null], 'the crowned month is July, the history straddling both ends');
+  same(who(crowns.month.winner), [HANDLE.PUB, ...PUB_IN.month], 'builder of the month: PUB’s 24 and two works');
+  same([crowns.year.start, crowns.year.since], [day(EDGE.year), day(EDGE.year)], 'the year so far, history having begun before it');
+  same(who(crowns.year.winner), [HANDLE.PUB, ...PUB_IN.year], 'builder of the year so far: PUB’s 508 and seven works');
+  same(crowns.year.last && [crowns.year.last.start, ...who(crowns.year.last.winner)], [day(EDGE.lastYear), HANDLE.PUB, ...PUB_IN.lastYear],
+    'builder of last year: PUB’s 3 and two works');
+
+  // 5 — The movers (D7): the last 30 days, rolling.
+  const movers = await read('/api/bongos/community/movers');
+  same([movers.window.start, movers.window.end], [EDGE.d30, NOW], 'the 30 days end now and open on the 30-day edge');
+  same(who(movers.rising), [HANDLE.PUB, ...PUB_IN['30d']], 'rising builder: PUB, 15 before the 30 days (under 100) and 496 in them');
+  same(movers.projects.map((p) => [p.name, p.origin, p.tasks_shipped, p.credits]), [[PROJECT, ORIGIN, 6, 501]],
+    'projects on the move: PUB’s five works and OPTOUT’s one; none of the kept-off accounts’ works count');
+
+  // 6 — A winner who hides (D8): gone from every surface on the next read, and no pinned
+  // period is handed to anyone else; only the live reads move on to OPTOUT.
+  await q('UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1', [ID.PUB]);
+  for (const w of ['all', '365d', '30d', '7d']) {
+    const board = await read(`/api/bongos/community/leaderboard?window=${w}&discipline=${TAG}&limit=100`);
+    same(board.results.map((r) => [r.place, r.handle, r.credits, r.tasks_shipped]), [[1, HANDLE.OPTOUT, ...OPTOUT_IN]], `${w} board after PUB hides: OPTOUT alone`);
+  }
+  const hidName = mine((await read(`/api/bongos/community/search?q=${PREFIX}&limit=50`)).results).find((r) => r.handle === HANDLE.PUB);
+  same(hidName && hidName.disciplines, null, 'search by name: PUB is still found, now name-only');
+  same(mine((await read(`/api/bongos/community/search?q=${PREFIX}&discipline=${TAG}&limit=50`)).results).map((r) => r.handle), [HANDLE.OPTOUT],
+    'search by craft: PUB is gone');
+  same((await read('/api/bongos/community/builder-of-the-week')).winner, null, 'the week PUB won shows nobody, though OPTOUT earned in it');
+  const hidCrowns = await read('/api/bongos/community/crowns');
+  same([hidCrowns.week.winner, hidCrowns.month.winner, hidCrowns.year.last], [null, null, null], 'the week, July and last year stay PUB’s and show nobody');
+  same(hidCrowns.year.winner, null, 'the year so far shows nobody while the leader’s memo is warm');
+  const hidMovers = await read('/api/bongos/community/movers');
+  same(who(hidMovers.rising), [HANDLE.OPTOUT, ...OPTOUT_IN], 'rising builder: OPTOUT, without waiting for the memo');
+  same(hidMovers.projects.map((p) => [p.name, p.tasks_shipped, p.credits]), [[PROJECT, 1, 5]], 'PUB’s works leave the project’s totals');
+  clock.now += 31 * 1000; // past every 30s memo; no snapshot sits within 31s of an edge
+  same(who((await read('/api/bongos/community/crowns')).year.winner), [HANDLE.OPTOUT, ...OPTOUT_IN], 'once the memo lapses, the year so far is OPTOUT’s');
+
+  // 7 — The sweep: an account kept off the boards is named by no body served above, but
+  // the name search the matrix allows it.
+  for (const k of KEPT_OFF) {
+    for (const r of SEEN) {
+      if (r.path.startsWith('/api/bongos/community/search?') && !r.path.includes('discipline=') && MATRIX[k].search !== 'absent') continue;
+      assert.ok(!r.text.includes(HANDLE[k]) && !r.text.includes(NAME[k]), `${k} was named by GET ${r.path}`);
+    }
+  }
+  same(SEEN.length, 19, 'the sweep read all 19 bodies served, each identical signed out and signed in, and no kept-off account is named where the matrix says absent');
+
+  console.log(`\ncommunity_proof_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  globalThis.Date = RealDate;
+  await new Promise((r) => server.close(r));
+  await pool.end().catch(() => {});
+}

package/tests/fixtures/privacy-matrix.mjs

@@ -0,0 +1,69 @@
+// tests/fixtures/privacy-matrix.mjs — the privacy spec's D2 table, transcribed ONCE
+// (docs/specs/bongos-v1-privacy-and-invites.md D2; task 1002973, shared since task 1002985).
+//
+// WHY A FIXTURE. Two proofs read these cells: tests/privacy_matrix.mjs walks every
+// surface DB-free through an interpreter that reads each statement's WHERE text, and
+// tests/community_proof_db.mjs runs the community surfaces against real Postgres. Two
+// transcriptions of one spec table would drift; a cell lives here or nowhere.
+
+// One fixture account per D2 row. The provisional account carries the MOST permissive
+// flags on purpose (public, shown, discoverable): D2 says provisional dominates every
+// flag, so nothing else may let it through.
+export const KEYS = ['PROV', 'PUB', 'SHY', 'PRIV', 'PRIVD', 'PRIVDH', 'OPTOUT'];
+export const STATE = {
+  PROV: { label: 'provisional (any flags)', profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
+  PUB: { label: 'active · public · stats shown', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  SHY: { label: 'active · public · hide_stats', profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  PRIV: { label: 'active · private (not discoverable)', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  PRIVD: { label: 'active · private · discoverable', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+  PRIVDH: { label: 'active · private · discoverable · hide_stats', profile_state: 'active', account_visibility: 'private', hide_stats: true, recruiter_discoverable: true },
+  OPTOUT: { label: 'active · public · opted out of recruiting', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
+};
+
+// THE MATRIX — spec D2, cell by cell for the surfaces that exist
+//
+//   profile    GET /profiles/:handle        Anon · Builder · Self's PUBLIC read (viewer-independent)
+//                404 | 'full' (record shown) | 'identity' (renders, record null)
+//   search     GET /community/search        Anon · Builder — "findable by name/handle"
+//                'listed' | 'name-only' (listed, disciplines null) | 'absent'
+//   board      GET /community/leaderboard   Anon · Builder — the cross-project leaderboard
+//                'listed' | 'absent'
+//   week       GET /community/builder-of-the-week   Anon · Builder · Recruiter — the crown and
+//                the past weeks (task 1002981, spec D5): a row IS stats, so the board's rule.
+//                Every fixture account has won a recorded week, so the read's own predicate
+//                decides: 'listed' | 'absent'
+//   crowns     GET /community/crowns        Anon · Builder · Recruiter — the builders of the month,
+//                the year so far and last year (task 1004902): a crown IS stats, so the board's
+//                rule. Each account in turn is made the winner of all three, so the reads'
+//                own predicates decide: 'listed' | 'absent'
+//   movers     GET /community/movers        Anon · Builder · Recruiter — the rising builder and the
+//                projects on the move (task 1002983): a card IS stats, so the board's rule, and
+//                a project's totals are the sum of what may be shown. Each account in turn is
+//                the one who moved, so the reads' own predicates decide: 'listed' | 'absent'
+//   directory  GET /scouting              Recruiter — 'full' | 'name-only' | 'absent'
+//   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
+//   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
+//   guild      GET /guilds/:slug            Anon · Builder · Recruiter · Self — the guild page's PUBLIC
+//                roster (task 1002301; ADR 0336 D4), viewer-independent: 'listed' | 'absent'.
+//                Every fixture account is a member with shown_publicly ON, so the account
+//                predicates alone decide; hide_stats never hides membership (D4 §2)
+//   members    GET /guilds/:slug/members    a fellow Member — the own-scope roster: 'listed' |
+//                'absent'. Joining is consent to be seen BY THE GUILD (D4 §1), so a private
+//                member is listed here and nowhere public; a provisional account is never
+//   invite     POST /projects/invite-guild  a project's Inviter (task 1002303; ADR 0365 D3) — one
+//                hall link per member of a PUBLIC guild's public roster: 'listed' | 'absent'.
+//                It reads accounts across projects, so it may hand the inviter exactly the
+//                people the guild page already shows them — shown_publicly AND existence;
+//                hide_stats never hides membership, and private or provisional is never listed
+//
+// The week/crowns/movers wording above describes privacy_matrix.mjs's fixture; the real-DB
+// proof seeds history instead and reads the same cells.
+export const MATRIX = {
+  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+};

package/tests/privacy_matrix.mjs

@@ -11,7 +11,7 @@
 // them is, is THE TABLE. This file is: one fixture account per D2 row, every
 // viewer column, every cross-project surface that exists today, run through the
 // real routers in one process, and asserted against a literal transcription of
-// the spec's cells (MATRIX below). A cell that drifts — a surface added without
+// the spec's cells (MATRIX, tests/fixtures/privacy-matrix.mjs). A cell that drifts — a surface added without
 // the predicate, a predicate loosened for one reader — reds here as the cell it
 // is, beside the six it should still agree with.
 //
@@ -69,6 +69,8 @@ import {
   scoutingListableSql,
   scoutingNameOnlySql,
 } from '../modules/platform-identity/account-visibility.js';
+// The D2 rows and their cells, shared with tests/community_proof_db.mjs (task 1002985).
+import { KEYS, STATE, MATRIX } from './fixtures/privacy-matrix.mjs';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
@@ -79,20 +81,8 @@ const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 // ===========================================================================
 //
 // Every value is an improbable per-account literal, so "absent from the body"
-// means absent. The provisional account carries the MOST permissive flags on
-// purpose (public, shown, discoverable, terms accepted): D2 says provisional
-// dominates every flag, so nothing else may let it through.
-
-const KEYS = ['PROV', 'PUB', 'SHY', 'PRIV', 'PRIVD', 'PRIVDH', 'OPTOUT'];
-const STATE = {
-  PROV: { label: 'provisional (any flags)', profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
-  PUB: { label: 'active · public · stats shown', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
-  SHY: { label: 'active · public · hide_stats', profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
-  PRIV: { label: 'active · private (not discoverable)', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
-  PRIVD: { label: 'active · private · discoverable', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
-  PRIVDH: { label: 'active · private · discoverable · hide_stats', profile_state: 'active', account_visibility: 'private', hide_stats: true, recruiter_discoverable: true },
-  OPTOUT: { label: 'active · public · opted out of recruiting', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
-};
+// means absent. KEYS and STATE (the flags, the provisional row the most
+// permissive on purpose) are tests/fixtures/privacy-matrix.mjs's.
 
 const ACCOUNTS = KEYS.map((k, i) => {
   const id = String(3120001 + i);
@@ -144,48 +134,8 @@ function identitySentinels(acct) {
 // THE MATRIX — spec D2, transcribed cell by cell for the surfaces that exist
 // ===========================================================================
 //
-//   profile    GET /profiles/:handle        Anon · Builder · Self's PUBLIC read (viewer-independent)
-//                404 | 'full' (record shown) | 'identity' (renders, record null)
-//   search     GET /community/search        Anon · Builder — "findable by name/handle"
-//                'listed' | 'name-only' (listed, disciplines null) | 'absent'
-//   board      GET /community/leaderboard   Anon · Builder — the cross-project leaderboard
-//                'listed' | 'absent'
-//   week       GET /community/builder-of-the-week   Anon · Builder · Recruiter — the crown and
-//                the past weeks (task 1002981, spec D5): a row IS stats, so the board's rule.
-//                Every fixture account has won a recorded week, so the read's own predicate
-//                decides: 'listed' | 'absent'
-//   crowns     GET /community/crowns        Anon · Builder · Recruiter — the builders of the month,
-//                the year so far and last year (task 1004902): a crown IS stats, so the board's
-//                rule. Each account in turn is made the winner of all three, so the reads'
-//                own predicates decide: 'listed' | 'absent'
-//   movers     GET /community/movers        Anon · Builder · Recruiter — the rising builder and the
-//                projects on the move (task 1002983): a card IS stats, so the board's rule, and
-//                a project's totals are the sum of what may be shown. Each account in turn is
-//                the one who moved, so the reads' own predicates decide: 'listed' | 'absent'
-//   directory  GET /scouting              Recruiter — 'full' | 'name-only' | 'absent'
-//   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
-//   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
-//   guild      GET /guilds/:slug            Anon · Builder · Recruiter · Self — the guild page's PUBLIC
-//                roster (task 1002301; ADR 0336 D4), viewer-independent: 'listed' | 'absent'.
-//                Every fixture account is a member with shown_publicly ON, so the account
-//                predicates alone decide; hide_stats never hides membership (D4 §2)
-//   members    GET /guilds/:slug/members    a fellow Member — the own-scope roster: 'listed' |
-//                'absent'. Joining is consent to be seen BY THE GUILD (D4 §1), so a private
-//                member is listed here and nowhere public; a provisional account is never
-//   invite     POST /projects/invite-guild  a project's Inviter (task 1002303; ADR 0365 D3) — one
-//                hall link per member of a PUBLIC guild's public roster: 'listed' | 'absent'.
-//                It reads accounts across projects, so it may hand the inviter exactly the
-//                people the guild page already shows them — shown_publicly AND existence;
-//                hide_stats never hides membership, and private or provisional is never listed
-const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', crowns: 'absent', movers: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', crowns: 'listed', movers: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-};
+// MATRIX lives in tests/fixtures/privacy-matrix.mjs, with each column's viewers and
+// values, so the real-DB community proof reads the same cells (task 1002985).
 
 // ===========================================================================
 // The in-memory tables + their statement interpreter