@bongos/core 1.24.64 → 1.24.66

package/scripts/bongos/ship-grade-steps.js

@@ -294,7 +294,9 @@ async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles,
 // spawned here) so formatGradeOutcome stays unit-testable without a subprocess.
 function formatOutageDiagnostic(g, cliFinding) {
   const out = [];
-  const dead = (g.signals?.workers || []).filter((w) => w && w.error);
+  // task 1005101: a single-shot outage (trivial diff / no-artifact) has no
+  // panel workers; its dead shots ride signals.outage_shots in the same shape.
+  const dead = (g.signals?.workers || g.signals?.outage_shots || []).filter((w) => w && w.error);
   const detailed = dead.filter((w) => w.exit_code != null || w.stderr_tail);
   if (detailed.length) {
     out.push('');

package/src/bongos/prelaunch-gate.js

@@ -248,25 +248,13 @@ function prelaunchGate() {
         if (body.length > 4096) req.destroy();   // a password is not a payload
       });
       req.on('end', () => {
-        const params = new URLSearchParams(body);
-        const given = params.get('password') || '';
-        const want = password();
-        const ok = given.length === want.length
-          && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(want));
-        // re-validated on the way back: the field is visitor-supplied
-        const returnTo = relativeReturn(params.get('return'));
-        if (!ok) {
-          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true, returnTo }));
+        // A plain event-emitter callback: a throw here is uncaught and kills the
+        // process, so any failure answers 400 instead (task 1004380).
+        try {
+          answerSubmit(req, res, body);
+        } catch {
+          if (!res.headersSent) res.status(400).type('text').send('Bad request');
         }
-        res.cookie(COOKIE, expectedToken(), {
-          httpOnly: true,
-          secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
-          sameSite: 'lax',
-          path: '/',
-          ...domainOpts(req),
-          // no maxAge/expires — a SESSION cookie, by the owner's choice
-        });
-        res.redirect(303, returnTo || '/');
       });
       return undefined;
     }
@@ -283,6 +271,34 @@ function prelaunchGate() {
   };
 }
 
+// Compare fixed-length digests: a character-length check is not a byte-length
+// check (a non-ASCII guess passed it, then timingSafeEqual threw on the byte
+// mismatch — task 1004380), and digesting both sides also hides the length.
+function passwordMatches(given) {
+  const digest = (s) => crypto.createHash('sha256').update(String(s), 'utf8').digest();
+  return crypto.timingSafeEqual(digest(given), digest(password()));
+}
+
+function answerSubmit(req, res, body) {
+  const params = new URLSearchParams(body);
+  const given = params.get('password') || '';
+  const ok = passwordMatches(given);
+  // re-validated on the way back: the field is visitor-supplied
+  const returnTo = relativeReturn(params.get('return'));
+  if (!ok) {
+    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true, returnTo }));
+  }
+  res.cookie(COOKIE, expectedToken(), {
+    httpOnly: true,
+    secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
+    sameSite: 'lax',
+    path: '/',
+    ...domainOpts(req),
+    // no maxAge/expires — a SESSION cookie, by the owner's choice
+  });
+  return res.redirect(303, returnTo || '/');
+}
+
 module.exports = {
   prelaunchGate, enabled, isExempt, tokenMatches, expectedToken, warnIfLegacyEnv,
   COOKIE, HMAC_LABEL, SUBMIT_PATH, LEGACY_SUBMIT_PATH, SUBMIT_PATHS,

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.66'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/cli_sessions.mjs

@@ -272,3 +272,85 @@ test('login names the other instances and how to move between them', () => {
   const fnStart = src.indexOf('function logOtherInstances');
   assert.ok(!/\/builder-/.test(src.slice(fnStart, fnStart + 700)), 'no slash command in terminal guidance');
 });
+
+// ── 4. Every command reads the session for the instance it TARGETS (task 1005117) ───────────
+//
+// THE BUG. The store above kept every instance's session, but every command still read the ONE
+// active pointer. So signing in to a second instance (toast.cloudbongos.com) mid-run rewrote that
+// pointer, and a run steered at the first instance by <PREFIX>_API_BASE then sent the SECOND
+// instance's token to the first — every claim and ship 401'd until a re-paste. The fix keys the
+// read by target: when a command's target host differs from the active pointer's, the store's
+// session for the target wins. With no known target, or nothing stored for it, the single active
+// file is read exactly as before — that is the backward compatibility.
+
+test('a run targeting instance A uses A\'s session even after signing in to B', () => {
+  const { out, status } = inSandbox(`
+    await lib.saveSession({ token:'TOKEN-A', api_base:'https://a.example.com', builder:{github_login:'x'} });
+    await lib.saveSession({ token:'TOKEN-B', api_base:'https://b.example.com', builder:{github_login:'x'} });
+    process.env[ic.envPrefix() + '_API_BASE'] = 'https://a.example.com';
+    const s = await lib.loadSession();
+    const sync = lib.loadSessionSync();
+    const tok = lib.readSessionToken();
+    console.log(JSON.stringify({ async: s.token, sync: sync.token, raw: tok.token, base: tok.apiBase }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.async, 'TOKEN-A', 'loadSession sent the last sign-in\'s token to another instance — the bug');
+  assert.equal(r.sync, 'TOKEN-A');
+  assert.equal(r.raw, 'TOKEN-A');
+  assert.equal(r.base, 'https://a.example.com');
+});
+
+test('with no target, or nothing stored for it, the single active file is read as before', () => {
+  const { out, status } = inSandbox(`
+    // A pre-store session: only the active pointer exists.
+    const active = ic.configPath(ic.SESSION_FILENAMES[0]);
+    fs.mkdirSync(path.dirname(active), { recursive: true });
+    fs.writeFileSync(active, JSON.stringify({ token:'OLD', api_base:'https://a.example.com' }));
+    const plain = (await lib.loadSession()).token;
+    process.env[ic.envPrefix() + '_API_BASE'] = 'https://elsewhere.example.com';
+    const unstored = (await lib.loadSession()).token;
+    console.log(JSON.stringify({ plain, unstored }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.plain, 'OLD');
+  assert.equal(r.unstored, 'OLD', 'an unstored target must fall back to the active file, never to no session');
+});
+
+test('signing in to B still archives the ACTIVE session, not the targeted one', () => {
+  const { out, status } = inSandbox(`
+    await lib.saveSession({ token:'TOKEN-A', api_base:'https://a.example.com' });
+    await lib.saveSession({ token:'TOKEN-B', api_base:'https://b.example.com' });
+    process.env[ic.envPrefix() + '_API_BASE'] = 'https://a.example.com';
+    await lib.saveSession({ token:'TOKEN-C', api_base:'https://c.example.com' });
+    const b = await lib.loadStoredSession('https://b.example.com');
+    console.log(JSON.stringify({ b: b && b.token, hosts: lib.listStoredSessions().map(h=>h.host) }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.b, 'TOKEN-B');
+  assert.deepEqual(r.hosts, ['a.example.com', 'b.example.com', 'c.example.com']);
+});
+
+// The bug report's own case: a BRANDED checkout (config/branding.json → its publicOrigin) whose
+// active pointer was rewritten by a sign-in to another instance. Driven purely, with the brand and
+// the instance-config probe injected, so it never depends on this checkout's real branding.
+const BRAND_A = { domains: { publicOrigin: 'https://a.example.com' }, repo: { envPrefix: 'ZZTEST' } };
+
+test('a branded checkout targets its own publicOrigin, a neutral one targets nothing', () => {
+  assert.equal(lib.sessionTargetBase({ env: {}, brand: BRAND_A, hasInstanceConfig: () => true }), 'https://a.example.com');
+  assert.equal(lib.sessionTargetBase({ env: {}, brand: BRAND_A, hasInstanceConfig: () => false }), null);
+});
+
+test('the injected brand\'s OWN env prefix steers the target', () => {
+  const prefix = ic.envPrefix(BRAND_A);
+  const env = { [`${prefix}_API_BASE`]: 'https://override.example.com' };
+  assert.equal(lib.sessionTargetBase({ env, brand: BRAND_A, hasInstanceConfig: () => true }), 'https://override.example.com');
+});
+
+test('a branded checkout whose active pointer belongs to another instance reads its OWN stored session', () => {
+  const opts = { env: {}, brand: BRAND_A, hasInstanceConfig: () => true };
+  const strayB = { token: 'TOKEN-B', api_base: 'https://b.example.com' };
+  assert.equal(lib.targetStorePath(strayB, opts), path.join(lib.sessionStoreDir(), 'a.example.com.json'));
+  // Already on target, or no target: keep the active session, read nothing.
+  assert.equal(lib.targetStorePath({ token: 'A', api_base: 'https://a.example.com' }, opts), null);
+  assert.equal(lib.targetStorePath(strayB, { ...opts, hasInstanceConfig: () => false }), null);
+});

package/tests/community_proof_db.mjs

@@ -0,0 +1,334 @@
+// tests/community_proof_db.mjs — PROOF: the privacy matrix and the window math on every
+// community surface, against real Postgres (task 1002985, goal 1000110 CT9;
+// docs/specs/bongos-v1-community-tab.md D3, D4, D5, D7 and D8).
+//
+// WHAT THIS ADDS. tests/privacy_matrix.mjs proves every cell DB-free, through an
+// interpreter that reads each statement's WHERE text, and each surface's own _db test
+// proves its arithmetic on a fixture of its own. Neither runs ONE fixture through EVERY
+// surface on real SQL. This does: one account per D2 row with the cells of
+// tests/fixtures/privacy-matrix.mjs, one shared snapshot history, and the real routers
+// over HTTP — the leaderboard in every window, search by name and by craft, the builder
+// of the week, the crowns and the movers — each read signed out and signed in, and the
+// two bodies compared byte for byte.
+//
+// THE HISTORY. PUB's credits step up one hour after every window edge, by 1, 2, 4 … 256,
+// one work a step, so each window's total is a bitmask naming exactly the snapshots it
+// counted (510 = every step after the 365-day edge, 192 = the week's two). Every account
+// the matrix keeps off the boards gains 1000 a step: had any predicate let one through,
+// it would top that board and take that crown, so its absence is never vacuous.
+//
+// THE CLOCK is frozen at NOW, a Wednesday in August 2097, because the routes take no
+// `now`. Every read is global, and those windows hold no real builder's snapshot, so a
+// shared database's own rows move nowhere in them (the crowns and movers _db precedent).
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION
+// set (scripts/bongos/run-unit-tests.js) so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/community_proof_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import http from 'node:http';
+import { strict as assert } from 'node:assert';
+import { KEYS, STATE, MATRIX } from './fixtures/privacy-matrix.mjs';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const express = require('express');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`community_proof_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// ---------------------------------------------------------------------------
+// The fixture
+// ---------------------------------------------------------------------------
+
+const PREFIX = 't1002985-';
+const TAG = 't1002985-craft'; // every fixture row's only craft; the board reads filter on it
+const ID = Object.fromEntries(KEYS.map((k, i) => [k, 90298501 + i]));
+// '-acct' keeps one handle from being a substring of another (priv / privd / privdh)
+const HANDLE = Object.fromEntries(KEYS.map((k) => [k, `${PREFIX}${k.toLowerCase()}-acct`]));
+const NAME = Object.fromEntries(KEYS.map((k) => [k, `T1002985 ${k} Acct`]));
+const IDS = Object.values(ID);
+const CLIENT = 't1002985-p1';
+const ORIGIN = 'https://t1002985-p1.example';
+const PROJECT = 'T1002985 Alpha';
+
+const NOW = '2097-08-14T12:00:00.000Z';
+const HISTORY = '2095-06-01T00:00:00.000Z'; // the first snapshot written: when history began
+// Every edge a surface reads, in time order. The routes' own answers are checked against
+// these below, so a fixture that stopped straddling them would fail, not pass vacuously.
+const EDGE = {
+  lastYear: '2096-01-01T00:00:00.000Z',
+  d365: '2096-08-14T12:00:00.000Z',
+  year: '2097-01-01T00:00:00.000Z',
+  month: '2097-07-01T00:00:00.000Z',
+  d30: '2097-07-15T12:00:00.000Z',
+  monthEnd: '2097-08-01T00:00:00.000Z',
+  week: '2097-08-05T00:00:00.000Z',
+  d7: '2097-08-07T12:00:00.000Z',
+  weekEnd: '2097-08-12T00:00:00.000Z',
+};
+const day = (iso) => iso.slice(0, 10);
+
+// PUB's numbers per window, read off its steps: the sum of the steps after the edge.
+const PUB_IN = {
+  all: [511, 9], // every step
+  '365d': [510, 8], // 2 … 256: the 365-day edge falls after the first step
+  '30d': [496, 5], // 16 … 256
+  '7d': [384, 2], // 128 + 256
+  week: [192, 2], // 64 + 128: the step after the week's end is the next week's
+  month: [24, 2], // 8 + 16: the step after the month's end is August's
+  year: [508, 7], // 4 … 256, the year so far
+  lastYear: [3, 2], // 1 + 2
+};
+// OPTOUT: 5 credits and one work at the 7-day edge plus two hours, so inside every rolling
+// window, the week and the year so far, and in neither July nor last year.
+const OPTOUT_IN = [5, 1];
+
+// The shared rule this history is built for: the boards, the crowns and the movers show
+// PUB and OPTOUT and nobody else (a crown or a card IS stats — the board's rule).
+const SHOWN = KEYS.filter((k) => MATRIX[k].board === 'listed');
+assert.deepEqual(SHOWN, ['PUB', 'OPTOUT'], 'the matrix changed — re-plan this history before trusting it');
+for (const k of KEYS) {
+  for (const col of ['week', 'crowns', 'movers']) assert.equal(MATRIX[k][col], MATRIX[k].board, `${k}.${col} no longer follows the board`);
+}
+const KEPT_OFF = KEYS.filter((k) => !SHOWN.includes(k));
+
+// ---------------------------------------------------------------------------
+// The frozen clock, the doorway and the real routers
+// ---------------------------------------------------------------------------
+
+// Every Date the modules make from here on is a FrozenDate. A Date made before the swap
+// would fail pg's `instanceof Date`, so fixture times go to SQL as ISO strings.
+const RealDate = Date;
+const clock = { now: RealDate.parse(NOW) };
+class FrozenDate extends RealDate {
+  constructor(...args) {
+    if (args.length) super(...args);
+    else super(clock.now);
+  }
+
+  static now() {
+    return clock.now;
+  }
+}
+globalThis.Date = FrozenDate;
+const after = (iso, hours) => new RealDate(RealDate.parse(iso) + hours * 3600 * 1000).toISOString();
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath,
+  filename: moduleApiPath,
+  loaded: true,
+  exports: {
+    pool,
+    corsPublicGet: () => (_req, _res, next) => next(),
+    logger: () => ({ error: (o, m) => console.error(`route error: ${m}`, o), info: () => {}, warn: () => {} }),
+  },
+};
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const f of ['community-search', 'community-leaderboard']) {
+  app.use('/api/bongos', require(`../modules/platform-identity/routes/${f}.js`)());
+}
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+const SIGNED_IN = { Authorization: 'Bearer t1002985-viewer', Cookie: 'bongos_session=t1002985-viewer' };
+const SEEN = []; // every body served, for the sweep at the end
+function get(path, headers) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path, headers, agent: false }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, text: Buffer.concat(chunks).toString('utf8') }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+// A surface read signed out and signed in: the same bytes to both (spec D3, D8).
+async function read(path) {
+  const anon = await get(path, {});
+  const signed = await get(path, SIGNED_IN);
+  assert.equal(anon.status, 200, `${path} → ${anon.status}: ${anon.text.slice(0, 300)}`);
+  assert.equal(signed.text, anon.text, `${path}: a signed-in viewer got a different body`);
+  SEEN.push({ path, text: anon.text });
+  return JSON.parse(anon.text);
+}
+
+const q = (sql, params) => pool.query(sql, params);
+let pass = 0;
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+const who = (w) => w && [w.handle, w.credits, w.tasks_shipped];
+const mine = (rows) => rows.filter((r) => r.handle.startsWith(PREFIX));
+
+async function cleanup() {
+  await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_projects WHERE origin = $1', [ORIGIN]).catch(() => {});
+  await q('DELETE FROM platform_identity_sso_clients WHERE client_id = $1', [CLIENT]).catch(() => {});
+  await q('DELETE FROM platform_identity_weekly_features WHERE week_start = $1::date', [day(EDGE.week)]).catch(() => {});
+  await q(
+    `DELETE FROM platform_identity_period_features
+      WHERE (period = 'month' AND period_start = $1::date) OR (period = 'year' AND period_start = $2::date)`,
+    [day(EDGE.month), day(EDGE.lastYear)],
+  ).catch(() => {});
+}
+
+// One (project, builder) row, seen since history began, and its cumulative snapshots.
+async function history(k, steps) {
+  const [, credits, ships] = steps[steps.length - 1];
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma, disciplines, first_seen_at)
+     VALUES ($1, $2, $3, $4, 0, $5, $6)`,
+    [CLIENT, ID[k], credits, ships, [TAG], HISTORY],
+  );
+  for (const [at, c, s] of steps) {
+    await q(
+      `INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at)
+       VALUES ($1, $2, $3, $4, 0, $5)`,
+      [CLIENT, ID[k], c, s, at],
+    );
+  }
+}
+// From zero at HISTORY, one step `hours` after each edge, `size(i)` credits and one work each.
+function stepsAfterEachEdge(hours, size) {
+  let credits = 0;
+  return [[HISTORY, 0, 0], ...Object.values(EDGE).map((edge, i) => {
+    credits += size(i);
+    return [after(edge, hours), credits, i + 1];
+  })];
+}
+
+try {
+  await q('CREATE EXTENSION IF NOT EXISTS pg_trgm');
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_004_projects.sql', 'platform_identity_005_builder_activity.sql',
+    'platform_identity_007_profile_consent.sql', 'platform_identity_008_handle.sql',
+    'platform_identity_011_project_visibility.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_019_terms_acceptance.sql', 'platform_identity_020_visibility_pull.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_023_builder_search_trgm.sql',
+    'platform_identity_032_weekly_features.sql', 'platform_identity_033_period_features.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  for (const k of KEYS) {
+    const s = STATE[k];
+    await q(
+      `INSERT INTO platform_identity_accounts
+         (github_id, github_login, display_name, handle, profile_state, account_visibility, hide_stats, recruiter_discoverable, terms_accepted_at)
+       VALUES ($1, $2, $3, $2, $4, $5, $6, $7, now())`,
+      [ID[k], HANDLE[k], NAME[k], s.profile_state, s.account_visibility, s.hide_stats, s.recruiter_discoverable],
+    );
+  }
+  await q(`INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin) VALUES ($1, 'x', $2, $3)`, [CLIENT, PROJECT, ORIGIN]);
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, description, featured, status, visibility, visibility_source)
+     VALUES ($1, $2, 'described', false, 'active', 'public', 'control-plane')`,
+    [ORIGIN, PROJECT],
+  );
+  await history('PUB', stepsAfterEachEdge(1, (i) => 2 ** i)); // first, so its HISTORY row is the first snapshot
+  await history('OPTOUT', [[HISTORY, 0, 0], [after(EDGE.d7, 2), ...OPTOUT_IN]]);
+  for (const k of KEPT_OFF) await history(k, stepsAfterEachEdge(2, () => 1000));
+
+  // 1 — The leaderboard in every window (D3): exactly the shown accounts, the numbers exact.
+  for (const [w, edge] of [['all', null], ['365d', EDGE.d365], ['30d', EDGE.d30], ['7d', EDGE.d7]]) {
+    const board = await read(`/api/bongos/community/leaderboard?window=${w}&discipline=${TAG}&limit=100`);
+    same(board.since, edge, `${w}: the window opens on the edge the history straddles`);
+    same(board.results.map((r) => [r.place, r.handle, r.credits, r.tasks_shipped]),
+      [[1, HANDLE.PUB, ...PUB_IN[w]], [2, HANDLE.OPTOUT, ...OPTOUT_IN]],
+      `${w} board: PUB ${PUB_IN[w][0]} and OPTOUT ${OPTOUT_IN[0]}; the five accounts kept off, each ahead of both, are absent`);
+  }
+
+  // 2 — Search (D4): findable by name per the matrix; a craft is stats, so the craft filter
+  // drops the hidden account the name search lists.
+  const byName = new Map(mine((await read(`/api/bongos/community/search?q=${PREFIX}&limit=50`)).results).map((r) => [r.handle, r]));
+  for (const k of KEYS) {
+    const r = byName.get(HANDLE[k]);
+    const got = !r ? 'absent' : r.disciplines === null ? 'name-only' : 'listed';
+    same(got, MATRIX[k].search, `search by name, ${STATE[k].label}: ${MATRIX[k].search}`);
+    if (got === 'listed') same(r.disciplines, [TAG], `${k}'s crafts are its own`);
+  }
+  const byCraft = mine((await read(`/api/bongos/community/search?q=${PREFIX}&discipline=${TAG}&limit=50`)).results);
+  same(byCraft.map((r) => r.handle).sort(), KEYS.filter((k) => MATRIX[k].search === 'listed').map((k) => HANDLE[k]).sort(),
+    'search by craft: the hidden account found by name is absent');
+
+  // 3 — The builder of the week (D5): the last full Monday-to-Monday week, crowned at render.
+  const bow = await read('/api/bongos/community/builder-of-the-week');
+  same([bow.week.start, bow.week.end], [day(EDGE.week), day(EDGE.weekEnd)], 'the crowned week is the one the history straddles');
+  same(who(bow.winner), [HANDLE.PUB, ...PUB_IN.week], 'builder of the week: PUB’s 192 and two works');
+  same(mine(bow.past), [], 'no fixture account in the past weeks');
+
+  // 4 — The crowns: the month and last year crowned at render, the year so far live.
+  const crowns = await read('/api/bongos/community/crowns');
+  same(who(crowns.week.winner), [HANDLE.PUB, ...PUB_IN.week], 'the home’s week is the same crown');
+  same([crowns.month.start, crowns.month.end, crowns.month.first_crown], [day(EDGE.month), day(EDGE.monthEnd), null], 'the crowned month is July, the history straddling both ends');
+  same(who(crowns.month.winner), [HANDLE.PUB, ...PUB_IN.month], 'builder of the month: PUB’s 24 and two works');
+  same([crowns.year.start, crowns.year.since], [day(EDGE.year), day(EDGE.year)], 'the year so far, history having begun before it');
+  same(who(crowns.year.winner), [HANDLE.PUB, ...PUB_IN.year], 'builder of the year so far: PUB’s 508 and seven works');
+  same(crowns.year.last && [crowns.year.last.start, ...who(crowns.year.last.winner)], [day(EDGE.lastYear), HANDLE.PUB, ...PUB_IN.lastYear],
+    'builder of last year: PUB’s 3 and two works');
+
+  // 5 — The movers (D7): the last 30 days, rolling.
+  const movers = await read('/api/bongos/community/movers');
+  same([movers.window.start, movers.window.end], [EDGE.d30, NOW], 'the 30 days end now and open on the 30-day edge');
+  same(who(movers.rising), [HANDLE.PUB, ...PUB_IN['30d']], 'rising builder: PUB, 15 before the 30 days (under 100) and 496 in them');
+  same(movers.projects.map((p) => [p.name, p.origin, p.tasks_shipped, p.credits]), [[PROJECT, ORIGIN, 6, 501]],
+    'projects on the move: PUB’s five works and OPTOUT’s one; none of the kept-off accounts’ works count');
+
+  // 6 — A winner who hides (D8): gone from every surface on the next read, and no pinned
+  // period is handed to anyone else; only the live reads move on to OPTOUT.
+  await q('UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1', [ID.PUB]);
+  for (const w of ['all', '365d', '30d', '7d']) {
+    const board = await read(`/api/bongos/community/leaderboard?window=${w}&discipline=${TAG}&limit=100`);
+    same(board.results.map((r) => [r.place, r.handle, r.credits, r.tasks_shipped]), [[1, HANDLE.OPTOUT, ...OPTOUT_IN]], `${w} board after PUB hides: OPTOUT alone`);
+  }
+  const hidName = mine((await read(`/api/bongos/community/search?q=${PREFIX}&limit=50`)).results).find((r) => r.handle === HANDLE.PUB);
+  same(hidName && hidName.disciplines, null, 'search by name: PUB is still found, now name-only');
+  same(mine((await read(`/api/bongos/community/search?q=${PREFIX}&discipline=${TAG}&limit=50`)).results).map((r) => r.handle), [HANDLE.OPTOUT],
+    'search by craft: PUB is gone');
+  same((await read('/api/bongos/community/builder-of-the-week')).winner, null, 'the week PUB won shows nobody, though OPTOUT earned in it');
+  const hidCrowns = await read('/api/bongos/community/crowns');
+  same([hidCrowns.week.winner, hidCrowns.month.winner, hidCrowns.year.last], [null, null, null], 'the week, July and last year stay PUB’s and show nobody');
+  same(hidCrowns.year.winner, null, 'the year so far shows nobody while the leader’s memo is warm');
+  const hidMovers = await read('/api/bongos/community/movers');
+  same(who(hidMovers.rising), [HANDLE.OPTOUT, ...OPTOUT_IN], 'rising builder: OPTOUT, without waiting for the memo');
+  same(hidMovers.projects.map((p) => [p.name, p.tasks_shipped, p.credits]), [[PROJECT, 1, 5]], 'PUB’s works leave the project’s totals');
+  clock.now += 31 * 1000; // past every 30s memo; no snapshot sits within 31s of an edge
+  same(who((await read('/api/bongos/community/crowns')).year.winner), [HANDLE.OPTOUT, ...OPTOUT_IN], 'once the memo lapses, the year so far is OPTOUT’s');
+
+  // 7 — The sweep: an account kept off the boards is named by no body served above, but
+  // the name search the matrix allows it.
+  for (const k of KEPT_OFF) {
+    for (const r of SEEN) {
+      if (r.path.startsWith('/api/bongos/community/search?') && !r.path.includes('discipline=') && MATRIX[k].search !== 'absent') continue;
+      assert.ok(!r.text.includes(HANDLE[k]) && !r.text.includes(NAME[k]), `${k} was named by GET ${r.path}`);
+    }
+  }
+  same(SEEN.length, 19, 'the sweep read all 19 bodies served, each identical signed out and signed in, and no kept-off account is named where the matrix says absent');
+
+  console.log(`\ncommunity_proof_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  globalThis.Date = RealDate;
+  await new Promise((r) => server.close(r));
+  await pool.end().catch(() => {});
+}