@bongos/core 1.18.3 → 1.18.19

package/tests/grade_attribution.mjs

@@ -76,15 +76,16 @@ const passingGrade = {
   rubric_scores: {}, signals: {}, issues: [], notes_md: null,
 };
 
-await test('grade: credit_log.builder_id is the CLAIM HOLDER, not the caller', async () => {
+await test('grade: pay-on-land — NO per-task credit at grader-confirm; attribution is the claim holder', async () => {
   const pool = fakePool({ claimHolderId: WORKER, task: TASK });
   const out = await applyGrade({ taskId: TASK.id, builderId: ARCHON, gradeResult: passingGrade }, { pool });
   assert.equal(out.taskStatus, 'confirmed');
+  // The #871 attribution guard still holds: creditedBuilderId is the claim
+  // holder, so when the credit DOES land (at ship) it lands on the worker.
   assert.equal(out.creditedBuilderId, WORKER, 'creditedBuilderId must be the claim holder');
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.ok(credit, 'a credit_log INSERT must run');
-  assert.equal(credit.params[0], WORKER, 'credit_log.builder_id must be the claim holder');
-  assert.notEqual(credit.params[0], ARCHON, 'credit must NOT land on the caller');
+  // ADR 0120: the per-task credit no longer lands at grader-confirm — it waits
+  // for the confirmed→shipped flip (shipTask). See tests/pay_on_land.mjs.
+  assert.equal(out.creditsAwarded, 0, 'no per-task credit at grader-confirm');
 });
 
 await test('grade: tasks.shipped_by ($2) is attributed to the claim holder, not the caller', async () => {
@@ -110,8 +111,7 @@ await test('grade: NO claim on the task → falls back to the caller (never refu
   const pool = fakePool({ claimHolderId: null, task: TASK });
   const out = await applyGrade({ taskId: TASK.id, builderId: ARCHON, gradeResult: passingGrade }, { pool });
   assert.equal(out.creditedBuilderId, ARCHON, 'with no claim the caller is the only candidate');
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.equal(credit.params[0], ARCHON);
+  assert.equal(out.creditsAwarded, 0, 'still no per-task credit at grader-confirm (lands at ship)');
 });
 
 summary();

package/tests/hall_audit.mjs

@@ -0,0 +1,223 @@
+// tests/hall_audit.mjs — the hall consistency audit, as a gate (task 2179).
+//
+// Task 2179 asked for an audit "checklist all green, recorded in ship notes".
+// A checklist in a ship note is a claim about one moment; it cannot stop the
+// thing it checked from coming back. These are the same assertions expressed as
+// tests, so the audit re-runs on every change instead of once.
+//
+// Each assertion carries its exceptions inline, with the reason. An exception
+// list that must be edited to break the rule is the point: the edit is where the
+// conversation happens.
+//
+// Pure file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const pages = () => fs.readdirSync(HALL).filter((f) => f.endsWith('.html'));
+
+// ---- 1. page-local <style> stays small (the 2176 per-page-CSS rule) --------
+
+// Pages whose inline block predates the program or is deliberate. Numbers are
+// CURRENT sizes and act as a ratchet: growing one fails, shrinking one is free.
+// Task 1002446 re-examined all four and kept every one, with the real reason
+// rather than "predates the program" — knowing WHY is what tells the next
+// reader whether promoting it would actually fix anything.
+const INLINE_STYLE_BUDGET = {
+  'task.html': 27,        // the task-751 detail-page block, deliberate
+  // my-projects + scouting are standalone surfaces that load neither style.css
+  // nor shell.js: their block is not page-local styling ON the design system,
+  // it IS their whole stylesheet, down to a hardcoded palette. Moving those
+  // bytes into a .css file would change nothing that matters — what they
+  // actually need is adoption into the shell + the branding contract, which is
+  // a far larger change than a CSS relocation.
+  'my-projects.html': 36,
+  'scouting.html': 26,
+  // Genuinely page-local, and already token-derived. One line over the default;
+  // a whole stylesheet for the legend strip is not worth the extra request, and
+  // diagram-viewer.css is shared with primer.html so it is the wrong home.
+  'diagrams.html': 16,
+};
+const DEFAULT_INLINE_BUDGET = 15;
+
+function inlineStyleLines(html) {
+  let total = 0;
+  for (const m of html.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/g)) {
+    const body = m[1].trim();
+    if (body) total += body.split('\n').length;
+  }
+  return total;
+}
+
+test('no page grows its inline <style> past its budget (promote to per-page CSS)', () => {
+  const over = [];
+  for (const f of pages()) {
+    const n = inlineStyleLines(read(f));
+    const budget = INLINE_STYLE_BUDGET[f] ?? DEFAULT_INLINE_BUDGET;
+    if (n > budget) over.push(`${f}: ${n} lines > budget ${budget}`);
+  }
+  assert.deepEqual(over, [], 'give the page its own stylesheet (the task-2176 pattern)');
+});
+
+test('the inline-style budget actually CATCHES growth', () => {
+  const html = '<style>\n' + 'a{color:red}\n'.repeat(20) + '</style>';
+  assert.ok(inlineStyleLines(html) > DEFAULT_INLINE_BUDGET, 'a 20-line block exceeds the default budget');
+  assert.equal(inlineStyleLines('<p>no styles</p>'), 0);
+});
+
+// ---- 2. the detail-surface rule: overlays frozen to idea + blocker --------
+
+// `#/task/N` navigates to a page; `#/idea/N` and `#/blocker/N` overlay.
+// `#/goal/N` is a sub-route WITHIN the goals page, not a fourth overlay
+// namespace — goals-page.js owns it, and it never opens a modal over another page.
+const ALLOWED_HASH_ROUTES = new Set(['task', 'idea', 'blocker', 'goal']);
+
+test('no new #/… deep-link namespace has appeared', () => {
+  const found = new Set();
+  for (const f of fs.readdirSync(HALL).filter((x) => x.endsWith('.js'))) {
+    for (const m of read(f).matchAll(/#\/([a-z][a-z-]*)\//g)) found.add(m[1]);
+  }
+  assert.ok(found.size > 0, 'sanity: the scan found hash routes');
+  const unexpected = [...found].filter((n) => !ALLOWED_HASH_ROUTES.has(n));
+  assert.deepEqual(unexpected, [], 'overlays are frozen to idea + blocker (task navigates; goal is a goals-page sub-route)');
+});
+
+// ---- 3. the theming token block is the stable contract --------------------
+
+// style.css :root holds the pack-driven vars every other rule derives from. The
+// program was not allowed to change it; this pins the shape so a stray edit shows.
+test('style.css :root token block is intact', () => {
+  const css = read('style.css');
+  const start = css.indexOf(':root {');
+  assert.ok(start > 0, ':root block present');
+  const end = css.indexOf('\n}', start);
+  const block = css.slice(start, end);
+  // The load-bearing vars other rules color-mix against. Losing one silently
+  // breaks derived colours across every page rather than erroring.
+  for (const v of ['--bg', '--surface', '--surface-2', '--border', '--ink', '--ink-soft', '--ink-faint', '--accent', '--accent-weak', '--radius']) {
+    assert.ok(block.includes(v + ':'), `${v} still defined in :root`);
+  }
+});
+
+// ---- 4. deleted CSS stays deleted ----------------------------------------
+
+// The hallux-t03 security/roster/admin leftovers, removed in task 2179 after a
+// per-class word-boundary scan. Listed so a revert or a copy-paste brings them
+// back loudly. NB `.voices__select` is NOT here: the class is live in markup but
+// its rule was always overridden by settings.css's higher-specificity
+// `select.voices__select`, so no rule for it belongs in style.css either.
+const REMOVED_CLASSES = [
+  'sev-badge', 'sev-low', 'sev-medium', 'sev-high', 'sev-critical',
+  'security-audit-details', 'override__rationale',
+  'roster__stale', 'roster__inactive', 'roster__self',
+  'skill-prefs__select', 'skill-prefs__default',
+];
+
+test('the dead security/roster/admin rules have not come back', () => {
+  const css = read('style.css');
+  const back = REMOVED_CLASSES.filter((c) => new RegExp('\\.' + c + '(?![\\w-])').test(css));
+  assert.deepEqual(back, [], 'these were verified unused and deleted in task 2179');
+});
+
+test('the removed-class guard CATCHES a reintroduction, and tolerates lookalikes', () => {
+  const re = (c) => new RegExp('\\.' + c + '(?![\\w-])');
+  assert.equal(re('sev-low').test('.sev-low { color: red }'), true, 'a genuine reintroduction is caught');
+  // watch.css legitimately defines badge--sev-low; the guard must not match it.
+  assert.equal(re('sev-low').test('.badge--sev-low { color: red }'), false,
+    'a different class that merely ends with the name is not a reintroduction');
+  assert.match(read('watch.css'), /\.badge--sev-low/, 'watch.css still owns the live severity styles');
+});
+
+// ---- 5. the page never scrolls sideways (task 1002446) --------------------
+
+// Measured at 390w against origin/main before the fix: leaderboard 218px,
+// drachmae 89px, index/Standing 62px (the .rank-tip), Home 8px. Each is carried
+// by one rule, and each rule is one edit away from being lost — so the rules are
+// pinned here rather than left to the next screenshot sweep to rediscover.
+test('the phone-width overflow guards are all still in place', () => {
+  const css = read('style.css');
+  const scoped = (sheet, re, breakpoint) => {
+    // the block a rule sits in must be the narrow-width media query it was
+    // written for, or the rule is live on desktop too (or, worse, live nowhere).
+    const at = sheet.search(re);
+    assert.ok(at > 0, `rule missing: ${re}`);
+    const media = sheet.lastIndexOf('@media', at);
+    assert.ok(media >= 0, `${re} has no enclosing @media at all`);
+    const between = sheet.slice(media, at);
+    // A media block closes with `}` in column 0; anything after that is back at
+    // top level, so finding one means the nearest @media is not the enclosing
+    // one and the rule is really live everywhere.
+    assert.ok(!/\n\}/.test(between), `${re} sits AFTER its nearest @media closed — it is live at every width`);
+    // Pin the EXACT breakpoint, not a band: style.css guards at 640, primer.css
+    // at 760 (its only breakpoint, the one primer.js's matchMedia mirrors).
+    // Narrowing primer's to 640 "for consistency" would silently reopen the
+    // 641–760px band the rule exists to cover, so a tolerant regex would hide
+    // the very drift this test is here to catch.
+    assert.match(between, new RegExp(`max-width:\\s*${breakpoint}px`),
+      `${re} must sit in the max-width: ${breakpoint}px media query`);
+  };
+  scoped(css, /:has\(>\s*\.ledger\)\s*\{[^}]*overflow-x:\s*auto/, 640);
+  scoped(css, /\.ledger th\s*\{[^}]*position:\s*static/, 640);
+  scoped(css, /\.rank-tip\s*\{\s*display:\s*none/, 640);
+  scoped(read('primer.css'), /\.primer-article table\s*\{[^}]*overflow-x:\s*auto/, 760);
+});
+
+// The strip has to hold BOTH invariants, and the second one is the easy one to
+// lose: a first cut of this fix put `display: block; overflow-x: auto` on the
+// table itself, which scrolls a wide ledger correctly but re-wraps the rows in
+// an anonymous shrink-to-fit table box — measured at 390w on /profile,
+// #works-table's rows rendered 240px inside a 329px card (an 89px gap where the
+// th rule and row rules stopped short), and that is every empty ledger, not an
+// exotic case. Keeping the ledger a table is what keeps `width: 100%` filling.
+test('a ledger narrower than its card still fills it', () => {
+  const css = read('style.css');
+  assert.match(css, /\.ledger\s*\{\s*\n\s*width:\s*100%/,
+    '.ledger fills its card — that is the declaration the strip must not defeat');
+  assert.doesNotMatch(css, /\.ledger\s*\{[^}]*display:\s*block/,
+    '.ledger must stay a table; display:block shrink-to-fits its rows inside the card');
+});
+
+test('the sidebar scrolls its nav list, not the whole column', () => {
+  const css = read('style.css');
+  const nav = css.slice(css.indexOf('.app-sidebar__nav {'));
+  const block = nav.slice(0, nav.indexOf('\n}'));
+  // min-height:0 is what lets the flex child shrink below its content; without
+  // it the rule is inert and "Sign out" slides back under the fold.
+  assert.match(block, /overflow-y:\s*auto/, '.app-sidebar__nav is the scroller');
+  assert.match(block, /min-height:\s*0/, '.app-sidebar__nav needs min-height:0 to actually scroll');
+  const sidebar = css.slice(css.indexOf('.app-sidebar {'));
+  assert.doesNotMatch(sidebar.slice(0, sidebar.indexOf('\n}')), /overflow-y:\s*auto/,
+    '.app-sidebar must NOT scroll — that is what pushed sign-out off-screen');
+});
+
+// ---- 6. every hall list is paged through the kit (task 1002446) -----------
+
+test('the peer-recognition feed is paged through OTBKit, not by hand', () => {
+  assert.match(read('hall-widgets.js'), /pagerBarHtml\('acclaim'/, 'the acclaim card stamps the kit pager bar');
+  const js = read('builders.js');
+  assert.match(js, /makePager\('acclaim'/, 'acclaim has a kit pager');
+  assert.match(js, /paginate\(acclaimState\.tasks, acclaimPager\)/, 'rows are sliced by the kit');
+  assert.match(js, /wirePager\(acclaimPager/, 'prev/next/per-page are wired');
+  // A vote mutates one row in place; the held array has to learn about it or a
+  // page flip re-renders the pre-vote tally over the vote just cast.
+  assert.match(js, /acclaimState\.tasks = acclaimState\.tasks\.map/,
+    'a cast vote is written back into the paged array');
+});
+
+// ---- 7. the provenance note stays put (task 1002446) ----------------------
+
+// The 2179 density pass landed in a DIFFERENT commit (97cbef0) whose own message
+// declares this task "now redundant". Read only 1002446's diff and you conclude
+// the density pass was skipped; read only that message and you close three live
+// defects. The reconciliation is in the module doc, so pin that it survives the
+// next doc trim — a paragraph nothing depends on is the first thing cut.
+test('the module doc still records where the 2179 density pass landed', () => {
+  const doc = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/CLAUDE.md'), 'utf8');
+  assert.match(doc, /97cbef0/, 'names the commit that actually shipped part 1');
+  assert.match(doc, /--space-1/, 'and an anchor a reader can go verify it against');
+});

package/tests/hall_nav.mjs

@@ -0,0 +1,191 @@
+// tests/hall_nav.mjs — the hall sidebar's information architecture (task 2175).
+//
+// The sidebar is grouped by AUDIENCE of the data: the project (unlabeled), You,
+// Community, Docs, Archon. That grouping is only worth anything if it stays
+// true, so this executes the real shell.js in a minimal DOM stub (the
+// hall_signout.mjs pattern), captures the sidebar markup it renders, and asserts
+// the invariants that silently rot otherwise:
+//
+//   - the group order + membership (the IA itself),
+//   - every nav href resolves to a page that exists ("all links land"),
+//   - a group's head is never more permissive than its most permissive item
+//     (otherwise the head renders over an empty group),
+//   - Achievements has no nav entry, but #achievements still routes to Standing
+//     (task 2174 folded it in; the alias is what keeps old bookmarks working).
+//
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const SRC = fs.readFileSync(path.join(HALL, 'shell.js'), 'utf8');
+
+// Boot shell.js under a DOM stub and return { sidebarHtml, viewHidden }.
+// Elements are memoised per id so the assertions can inspect what the router did
+// to them (#view-standing etc.) after boot.
+function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
+  const els = new Map();
+  const makeEl = () => {
+    const el = {
+      dataset: {}, style: {}, title: '', textContent: '', hidden: false, _html: '',
+      classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+      setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+      addEventListener() {}, querySelectorAll() { return []; },
+      appendChild() {}, focus() {}, click() {}, scrollIntoView() {},
+      set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+    };
+    return el;
+  };
+
+  const location = {
+    hostname: 'builders.cloudbongos.com',
+    origin: 'https://builders.cloudbongos.com',
+    pathname, hash,
+    assign() {},
+  };
+
+  const documentObj = {
+    body: { dataset: { page } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById(id) {
+      if (!els.has(id)) els.set(id, makeEl());
+      return els.get(id);
+    },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+    dispatchEvent() {},
+    get cookie() { return ''; },
+    set cookie(_v) {},
+  };
+
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    // Index pages never reach probeMe (builders.js owns /me there); a non-index
+    // boot would, so hand back a never-settling promise rather than fake auth —
+    // these assertions are about the rendered model, not the gated state.
+    BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem() { return null; }, setItem() {} },
+    requestAnimationFrame() {},
+    scrollTo() {},
+    location,
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location, console, setTimeout, clearTimeout,
+    CustomEvent: class { constructor(type, init) { this.type = type; Object.assign(this, init); } },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'shell.js' });
+
+  return {
+    sidebarHtml: documentObj.getElementById('app-sidebar').innerHTML,
+    viewHidden: (v) => documentObj.getElementById('view-' + v).hidden,
+    shell: windowObj.OTBShell,
+  };
+}
+
+// Parse the rendered sidebar back into the nav model it came from. Deliberately
+// reads the MARKUP rather than importing NAV: what a builder sees is the markup,
+// and a render bug (a dropped group head, an unescaped href) shows up here.
+function parseNav(html) {
+  return html.split('<div class="nav-group').slice(1).map((block) => {
+    const label = (block.match(/nav-group__head-label">([^<]*)</) || [, ''])[1];
+    const headGate = (block.match(/class="nav-group__head" data-gate="([^"]+)"/) || [, null])[1];
+    const items = [...block.matchAll(/<a class="nav-item" id="nav-([^"]+)" href="([^"]*)"([^>]*)>/g)].map((m) => ({
+      id: m[1],
+      href: m[2],
+      gate: (m[3].match(/data-gate="([^"]+)"/) || [, null])[1],
+      external: / target="_blank"/.test(m[3]),
+    }));
+    return { label, headGate, items };
+  });
+}
+
+// Permissiveness ladder, widest first. A group head gated MORE widely than every
+// one of its items renders a label over nothing.
+const GATE_WIDTH = { always: 0, signed: 1, work: 1, member: 2, archon: 3 };
+const headOutOfRange = (g) =>
+  g.headGate != null && GATE_WIDTH[g.headGate] < Math.min(...g.items.map((i) => GATE_WIDTH[i.gate]));
+
+// A nav href must land: an index view hash, an external apex link, or a real
+// page file in the hall surface.
+function hrefResolves(item) {
+  if (item.external) return true;
+  const p = item.href.replace(/^\/#.*/, '/').replace(/^#.*/, '/');
+  const slug = p === '/' ? 'index' : p.replace(/^\//, '');
+  return fs.existsSync(path.join(HALL, slug + '.html'));
+}
+
+test('sidebar groups read by audience, in order', () => {
+  const nav = parseNav(boot().sidebarHtml);
+  assert.deepEqual(nav.map((g) => g.label), ['', 'You', 'Community', 'Docs', 'Archon']);
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work'],
+    'the unlabeled group is the project itself (task 1002425 order)');
+  assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard'], 'Community = everyone else');
+  assert.deepEqual(nav[3].items.map((i) => i.id),
+    ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions']);
+});
+
+test('Economy lives in Docs and points at the reward-schedule page', () => {
+  const nav = parseNav(boot().sidebarHtml);
+  const economy = nav.find((g) => g.label === 'Docs').items.find((i) => i.id === 'economy');
+  assert.ok(economy, 'Docs carries an Economy entry — /drachmae had no nav entry before task 2175');
+  assert.equal(economy.href, '/drachmae');
+  assert.ok(fs.existsSync(path.join(HALL, 'drachmae.html')), 'the page it points at exists');
+});
+
+test('every nav link lands on a page that exists', () => {
+  const items = parseNav(boot().sidebarHtml).flatMap((g) => g.items);
+  assert.ok(items.length >= 14, `sanity: parsed the whole nav, got ${items.length} items`);
+  const dead = items.filter((i) => !hrefResolves(i));
+  assert.deepEqual(dead, [], 'no nav item points at a missing page');
+});
+
+test('href check actually CATCHES a dead link', () => {
+  assert.equal(hrefResolves({ href: '/no-such-page', external: false }), false);
+  assert.equal(hrefResolves({ href: '/drachmae', external: false }), true);
+});
+
+test('no group head is gated wider than its own items', () => {
+  const bad = parseNav(boot().sidebarHtml).filter(headOutOfRange).map((g) => g.label);
+  assert.deepEqual(bad, [], 'a head gated wider than every item would render a label over nothing');
+});
+
+test('group-gate check actually CATCHES a head gated wider than its items', () => {
+  assert.equal(headOutOfRange({ label: 'X', headGate: 'signed', items: [{ gate: 'member' }] }), true,
+    'signed head over a member-only item is the bug');
+  assert.equal(headOutOfRange({ label: 'X', headGate: 'member', items: [{ gate: 'member' }] }), false);
+  assert.equal(headOutOfRange({ label: 'X', headGate: 'archon', items: [{ gate: 'archon' }] }), false);
+});
+
+test('Achievements has no nav entry, but #achievements still routes to Standing', () => {
+  const ids = parseNav(boot().sidebarHtml).flatMap((g) => g.items.map((i) => i.id));
+  assert.ok(!ids.includes('achievements'), 'the nav entry retired with task 2175');
+
+  // The alias is the compatibility contract task 2174 left behind — old
+  // bookmarks and the Standing stat tiles still link #achievements.
+  const idx = boot({ page: 'home', pathname: '/', hash: '#achievements' });
+  assert.equal(idx.viewHidden('standing'), false, '#achievements shows the Standing view');
+  assert.equal(idx.viewHidden('home'), true, 'and hides Home');
+  assert.equal(idx.shell.currentView(), 'standing');
+});
+
+test('collapsible groups carry a stable storage key (collapse persistence)', () => {
+  const html = boot().sidebarHtml;
+  for (const g of ['you', 'community', 'docs', 'archon']) {
+    assert.match(html, new RegExp(`data-group="${g}"`), `${g} is collapsible (hall-nav-collapsed key)`);
+  }
+  assert.ok(!/nav-group--collapsible[^>]*>(?!<button)/.test(html.split('<div class="nav-group')[1] || ''),
+    'the unlabeled project group stays always-expanded');
+});

package/tests/hall_palette.mjs

@@ -0,0 +1,206 @@
+// tests/hall_palette.mjs — the hall jump palette (task 2178).
+//
+// The palette indexes PAGES live from the rendered sidebar (so rank/module
+// gating can never drift), but its SUB-destinations — Standing sections, Tasks
+// tabs, Settings panels — cannot be read from another page's DOM, so palette.js
+// declares them statically. A static list pointing at ids that no longer exist
+// is a jump that silently goes nowhere, so the load-bearing test here holds that
+// list against its real sources.
+//
+// Also covers: the id syntaxes, gating (a hidden nav item is not a destination),
+// and the progressive-enhancement contract (shell.js renders the slot inert and
+// never calls into palette.js, so a page without palette.js just has no palette).
+//
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const PALETTE_SRC = read('palette.js');
+const SHELL_SRC = read('shell.js');
+
+// Boot palette.js against a DOM stub whose sidebar carries `navItems`, and whose
+// `visibleIds` decide which section groups are on offer. Returns window.OTBPalette.
+function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work', 'shell-user'], modules = null } = {}) {
+  const makeNav = (it) => ({
+    hidden: !!it.hidden,
+    target: it.external ? '_blank' : '',
+    getAttribute: (n) => (n === 'href' ? it.href : null),
+    querySelector: (sel) => (sel === '.nav-item__label' ? { textContent: it.label } : null),
+  });
+  const stubEl = () => ({
+    hidden: false, dataset: {}, textContent: '', value: '', className: '',
+    classList: { add() {}, remove() {}, contains() { return false; }, toggle() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    addEventListener() {}, appendChild() {}, focus() {}, querySelector() { return stubEl(); },
+    querySelectorAll() { return []; },
+    set innerHTML(_v) {}, get innerHTML() { return ''; },
+  });
+
+  const documentObj = {
+    body: { dataset: { page: 'home' }, appendChild() {} },
+    documentElement: { classList: { add() {}, remove() {} } },
+    getElementById(id) {
+      if (id === 'topbar-jump' || id === 'topbar-jump-kbd') return stubEl();
+      return visibleIds.includes(id) ? { hidden: false } : null;
+    },
+    querySelectorAll(sel) {
+      if (sel === '#app-sidebar .nav-item') return navItems.map(makeNav);
+      return [];
+    },
+    createElement: () => stubEl(),
+    addEventListener() {},
+    activeElement: null,
+  };
+  const windowObj = { location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
+  if (modules) windowObj.__MODULES__ = { enabled: modules };
+  const sandbox = {
+    window: windowObj, document: documentObj, navigator: { platform: 'Win32', userAgent: 'test' },
+    console,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(PALETTE_SRC, sandbox, { filename: 'palette.js' });
+  // Copy results across the realm boundary — a vm-created array has the sandbox's
+  // Array.prototype, which deepStrictEqual rejects even when the values match.
+  const P = windowObj.OTBPalette;
+  return { compute: (q) => Array.from(P.compute(q), (e) => ({ ...e })) };
+}
+
+const NAV_FIXTURE = [
+  { label: 'Home', href: '/' },
+  { label: 'Tasks', href: '/work' },
+  { label: 'Standing', href: '/#standing' },
+  { label: 'Economy', href: '/drachmae' },
+  { label: 'API docs', href: '/docs', external: true },
+  { label: 'Watch', href: '/watch', hidden: true },   // Archon-only, gated off
+];
+
+// ---- the drift guard: the static map vs its real sources ------------------
+
+// Anchors palette.js declares, by owning page.
+function declaredHrefs(prefixTest) {
+  return [...PALETTE_SRC.matchAll(/href:\s*'([^']+)'/g)].map((m) => m[1]).filter(prefixTest);
+}
+
+test('Standing section anchors exist in builders.js and are routable in shell.js', () => {
+  const groups = [...read('builders.js').matchAll(/\{ key: '([a-z]+)', label: '[^']+' \}/g)].map((m) => m[1]);
+  assert.ok(groups.length >= 4, `sanity: found STANDING_GROUPS (${groups})`);
+  const declared = declaredHrefs((h) => h.startsWith('/#standing-')).map((h) => h.replace('/#', ''));
+  assert.ok(declared.length, 'palette declares Standing sections');
+  for (const id of declared) {
+    const key = id.replace('standing-', '');
+    assert.ok(groups.includes(key), `${id} must be a real STANDING_GROUPS key (builders.js)`);
+    // shell.js must alias it, or route() ignores the hash and the jump goes nowhere.
+    assert.match(SHELL_SRC, new RegExp(`'${id}':\\s*\\{ view: 'standing', anchor: '${id}' \\}`),
+      `${id} must have a VIEW_ALIASES entry in shell.js`);
+  }
+});
+
+test('Tasks tab anchors exist in work.js makeTabs', () => {
+  const ids = [...read('work.js').matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
+  assert.ok(ids.length >= 4, `sanity: found work tabs (${ids})`);
+  for (const h of declaredHrefs((x) => x.startsWith('/work#'))) {
+    assert.ok(ids.includes(h.split('#')[1]), `${h} must be a real work.js tab id`);
+  }
+});
+
+test('Settings panel anchors exist in settings.js RAIL_GROUPS', () => {
+  // RAIL_GROUPS is derived: RAIL_ITEMS.map(i => i.id).concat('extensions').
+  const src = read('settings.js');
+  const block = (src.match(/RAIL_ITEMS\s*=\s*\[([\s\S]*?)\n\s*\];/) || [, ''])[1];
+  const ids = [...block.matchAll(/\{ id: '([a-z-]+)'/g)].map((m) => m[1]);
+  const concat = [...(src.match(/RAIL_GROUPS\s*=\s*RAIL_ITEMS[\s\S]*?\.concat\(([^;]*)\);/) || [, ''])[1]
+    .matchAll(/'([a-z-]+)'/g)].map((m) => m[1]);
+  const groups = ids.concat(concat);
+  assert.ok(groups.length >= 5, `sanity: derived RAIL_GROUPS (${groups})`);
+  for (const h of declaredHrefs((x) => x.startsWith('/settings#'))) {
+    assert.ok(groups.includes(h.split('#')[1]), `${h} must be a real settings.js rail group`);
+  }
+});
+
+test('the Dev box panel jump carries settings.js own dev-box module condition', () => {
+  // settings.js builds that panel only when moduleOn('dev-box'); offering the
+  // jump regardless would land on a panel that was never rendered.
+  assert.match(read('settings.js'), /moduleOn\('dev-box'\)\s*\?\s*\[\{ id: 'devbox'/,
+    'settings.js still gates the devbox panel on the module');
+  assert.match(PALETTE_SRC, /href: '\/settings#devbox', module: 'dev-box'/,
+    'so the palette entry must declare the same module');
+
+  const on = bootPalette({ navItems: NAV_FIXTURE, modules: { 'dev-box': true } }).compute('dev box');
+  assert.ok(on.some((r) => r.href === '/settings#devbox'), 'offered when the module is on');
+  const off = bootPalette({ navItems: NAV_FIXTURE, modules: { 'dev-box': false } }).compute('dev box');
+  assert.ok(!off.some((r) => r.href === '/settings#devbox'), 'withheld when the module is off');
+});
+
+test('the anchor guard actually CATCHES a declared id that does not exist', () => {
+  const groups = ['work', 'karma', 'progress', 'achievements'];
+  assert.equal(groups.includes('standing-nope'.replace('standing-', '')), false,
+    'an invented section id fails the membership check the tests above apply');
+});
+
+// ---- indexing + gating ----------------------------------------------------
+
+test('pages come from the sidebar, and a gated-off nav item is not a destination', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  const labels = P.compute('').filter((r) => r.group === 'Pages').map((r) => r.label);
+  assert.deepEqual(labels, ['Home', 'Tasks', 'Standing', 'Economy', 'API docs']);
+  assert.ok(!labels.includes('Watch'), 'a hidden (rank-gated) nav item must not be jumpable');
+});
+
+test('section groups appear only when their owning nav item is visible', () => {
+  const all = bootPalette({ navItems: NAV_FIXTURE }).compute('');
+  assert.ok(all.some((r) => r.group === 'Standing'), 'Standing sections offered when nav-standing shows');
+  assert.ok(all.some((r) => r.group === 'Settings'), 'Settings panels offered when the profile chip shows');
+
+  const gatedOut = bootPalette({ navItems: NAV_FIXTURE, visibleIds: [] }).compute('');
+  assert.ok(!gatedOut.some((r) => ['Standing', 'Tasks', 'Settings'].includes(r.group)),
+    'no sub-destinations when their owners are hidden');
+});
+
+test('the external API-docs entry is marked so it opens in a new tab', () => {
+  const hit = bootPalette({ navItems: NAV_FIXTURE }).compute('api docs')[0];
+  assert.equal(hit.label, 'API docs');
+  assert.equal(hit.external, true);
+});
+
+// ---- id syntax ------------------------------------------------------------
+
+test('id syntaxes resolve to the right destination', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  const top = (q) => P.compute(q)[0];
+  assert.deepEqual({ href: top('1234').href, overlay: !!top('1234').overlay }, { href: '/task/1234', overlay: false });
+  assert.equal(top('g 12').href, '/goals#/goal/12');
+  assert.equal(top('g12').href, '/goals#/goal/12', 'the space is optional');
+  assert.deepEqual({ href: top('b 7').href, overlay: top('b 7').overlay }, { href: '#/blocker/7', overlay: true });
+  assert.deepEqual({ href: top('i 42').href, overlay: top('i 42').overlay }, { href: '#/idea/42', overlay: true });
+  assert.equal(top('1234').group, 'Go to');
+});
+
+test('a non-matching query yields nothing (the empty state), and text still matches pages', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  assert.deepEqual(P.compute('zzzqqq'), []);
+  assert.equal(P.compute('econ')[0].label, 'Economy', 'substring match');
+  assert.equal(P.compute('stw')[0].label, 'Work', 'subsequence match reaches Standing > Work');
+});
+
+// ---- progressive enhancement + wiring -------------------------------------
+
+test('shell.js renders the jump slot inert and never calls into palette.js', () => {
+  assert.match(SHELL_SRC, /id="topbar-jump"[^>]*hidden/, 'the slot ships hidden');
+  assert.ok(!/OTBPalette/.test(SHELL_SRC), 'the shell must not depend on the palette');
+});
+
+test('every page that loads the shell also loads the palette', () => {
+  const pages = fs.readdirSync(HALL).filter((f) => f.endsWith('.html'));
+  const withShell = pages.filter((f) => /src="\/builders\/shell\.js/.test(read(f)));
+  assert.ok(withShell.length >= 15, `sanity: ${withShell.length} pages carry the shell`);
+  const missing = withShell.filter((f) => !/src="\/builders\/palette\.js/.test(read(f)));
+  assert.deepEqual(missing, [], 'Ctrl-K must work on every hall page');
+});