@bongos/core 1.19.1014 → 1.19.1016

package/tests/guild_namespace_reserved.mjs

@@ -0,0 +1,76 @@
+// tests/guild_namespace_reserved.mjs — the guild URL namespace is RESERVED where
+// project slugs are decided (task 1002299, R23 guild design; task 1002912's rule).
+//
+// Project profiles live at the top level (`cloudbongos.com/<slug>`), so every
+// top-level segment the hub uses for another kind of page must be on the reserved
+// project-slug list in the SEO spec, or a project can register the word and shadow
+// the namespace. `u` guards `/u/<handle>`; the guild design names its own segment,
+// and task 1002912 asked for the word to be reserved there, not a route squatted.
+//
+// No slug validator exists yet (the SEO goal's R02 builds it from that list), so the
+// spec IS the contract today. This pins the one property that can drift silently:
+// the segment the guild ADR declares and the segment the spec reserves are the same.
+//
+// Run:  node tests/guild_namespace_reserved.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+const SEO_SPEC = path.join(ROOT, 'docs', 'specs', 'bongos-v1-seo-public-discoverability.md');
+const GUILD_TASK = '1002299';
+
+const { test, summary } = makeRunner();
+
+// The guild design ADR, found by the task it records rather than by number: ADR
+// numbers get renumbered when two sessions collide, the task id never changes.
+function guildAdr() {
+  const hits = fs.readdirSync(ADR_DIR)
+    .filter((f) => /^\d{4}-.*\.md$/.test(f))
+    .filter((f) => {
+      const head = fs.readFileSync(path.join(ADR_DIR, f), 'utf8').replace(/\r\n/g, '\n').split('\n').slice(0, 12).join('\n');
+      return new RegExp(`^- \\*\\*Task:\\*\\*.*task ${GUILD_TASK}\\b`, 'm').test(head);
+    });
+  assert.equal(hits.length, 1, `exactly one ADR records task ${GUILD_TASK}; found ${JSON.stringify(hits)}`);
+  return fs.readFileSync(path.join(ADR_DIR, hits[0]), 'utf8').replace(/\r\n/g, '\n');
+}
+
+// The segment the ADR declares on its machine-readable `Namespace:` line.
+function declaredSegment(adr) {
+  const m = adr.match(/^- \*\*Namespace:\*\* `\/([a-z0-9-]+)\/<slug>`/m);
+  assert.ok(m, 'the guild ADR carries a `- **Namespace:** `/<segment>/<slug>`` header line');
+  return m[1];
+}
+
+// The reserved words in the SEO spec's Routing bullet: the backticked list after "Reserved:".
+function reservedWords() {
+  const spec = fs.readFileSync(SEO_SPEC, 'utf8').replace(/\r\n/g, '\n');
+  const routing = spec.split('\n').find((l) => l.startsWith('- **Routing:**'));
+  assert.ok(routing, 'the SEO spec still has its Routing bullet');
+  const m = routing.match(/Reserved: `([^`]+)`/);
+  assert.ok(m, 'the Routing bullet still names its reserved list as `Reserved: `…``');
+  return m[1].split(',').map((w) => w.trim()).filter(Boolean);
+}
+
+await test('the guild ADR declares one top-level namespace segment', () => {
+  const seg = declaredSegment(guildAdr());
+  assert.match(seg, /^[a-z0-9-]+$/);
+});
+
+await test('the SEO spec reserves the segment the guild ADR declares', () => {
+  const seg = declaredSegment(guildAdr());
+  const reserved = reservedWords();
+  assert.ok(reserved.includes(seg),
+    `a project could register "${seg}" and shadow /${seg}/<slug>; reserved list is ${JSON.stringify(reserved)}`);
+});
+
+await test('the builder-profile segment it was modelled on is still reserved', () => {
+  // The precedent the task names. If `u` ever leaves the list, the guild reservation
+  // above has lost the rule it was copied from, and both need a second look.
+  assert.ok(reservedWords().includes('u'));
+});
+
+summary();

package/tests/hall_audit.mjs

@@ -364,6 +364,7 @@ test('the module doc still records where the 2179 density pass landed', () => {
 // and the pack's font links like every hall page (the server injects them).
 const STANDALONE_EXEMPT = {
   'thinking.html': 'the sky (task 1004231, ADR 0331) — the design of record is its own surface, not the hall chrome',
+  'goal-map.html': 'the project sky (task 1004232) — the same surface as thinking.html, opened in its whole-project lens',
 };
 
 test('every hall page loads style.css and shell.js', () => {

package/tests/hall_nav.mjs

@@ -258,7 +258,12 @@ test('sidebar groups read by audience, in order', () => {
   // task 1003455 (goal 1000089): 'blockers' joins the same group, after Tasks —
   // its subject is the project (what's stuck on the owner), not a person or a
   // craft, and its one data source (GET /blockers) is public like Roadmap's.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'blockers', 'board-room', 'ideas', 'thinking', 'copy-desk', 'studio'],
+  // task 1004232 (sky part 4, goal 1000095): 'goal-map' — THE PROJECT SKY — joins
+  // directly under 'goals'. The goal map that held the URL took no nav slot on
+  // purpose (task 1003479, and tests/goal_map_page.mjs pinned it); the owner
+  // granted the sky that slot on 2026-09-24 (ADR 0227 §11), under Goals because
+  // it is the goals seen as one picture.
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'ideas', 'thinking', 'copy-desk', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.

package/tests/hall_page_gate_map.mjs

@@ -48,8 +48,9 @@ const ORACLE = {
   '/builders/atlas': 'requireBuilderPage',
   '/builders/modules': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
-  // task 1003479: the goal map. GET /goals/graph is requireBuilder like the goal board it
-  // maps, so the page sits on the same tier — and takes no nav slot (the sky's rule).
+  // task 1003479: the goal map, on the goal board's tier. task 1004232 (sky part 4):
+  // the URL now serves THE PROJECT SKY (the same page as /thinking, in its whole-project
+  // lens) on the same tier, and holds the nav slot under Goals the map was denied.
   '/builders/goal-map': 'requireBuilderPage',
   '/builders/roadmap': 'requireBuilderPage',
   // Gated at this tier all along, but with no row until task 1003448 walked the

package/tests/hall_sky.mjs

@@ -303,27 +303,44 @@ await test('the claude layer is HIDDEN until filed_via exists, and every thought
   assert.ok(p.S().ideas.every((i) => i.origin === 'human'));
 });
 
-await test('once filed_via is on a row the pill appears, that thought waits behind it, and historic rows still show', async () => {
-  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'session' }), idea({ id: 3, title: 'A person filed this', filed_via: 'person' })]) });
+await test('filed_via IS A LEDGER FACT (part 5): cli / api / discord wait behind the claude layer, hall / planning always show, and a row from before the column shows and says so', async () => {
+  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'cli' }), idea({ id: 3, title: 'A person filed this', filed_via: 'hall' }), idea({ id: 4, title: 'Planned', filed_via: 'planning' }), idea({ id: 5, title: 'A poller filed this', filed_via: 'api' }), idea({ id: 6, title: 'From Discord', filed_via: 'discord' })]), sky: sky([well()]) });
   assert.equal(p.S().hasFiledVia, true);
   assert.equal(p.el('claudeBtn').hidden, false);
   const SKY = p.SKY();
-  assert.equal(SKY.inLayer(findIdea(p, 2)), false, 'off by default: only what a person filed');
-  assert.equal(SKY.inLayer(findIdea(p, 10)), true, 'a historic row with no filed_via shows (the owner\'s rule)');
-  assert.equal(SKY.inLayer(findIdea(p, 3)), true);
+  same(SKY.SESSION_VIAS, ['cli', 'api', 'discord'], 'the doors a session files through');
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), false, `${id} waits behind the pill — off by default`);
+  for (const id of [10, 3, 4]) assert.equal(SKY.inLayer(findIdea(p, id)), true, `${id} shows`);
+  assert.equal(findIdea(p, 10).filedVia, null, 'a historic row carries NULL, not a guess');
   p.click('claudeBtn');
-  assert.equal(SKY.inLayer(findIdea(p, 2)), true, 'the pill reveals it');
-});
-
-await test('NO BORN-OF MARK IS DRAWN — the read does not exist yet, so nothing is guessed', async () => {
-  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
-  const S = p.S();
-  assert.equal(S.becameGoal.size, 0);
-  assert.equal(S.becameCrit.size, 0);
-  assert.ok(S.ideas.every((i) => i.shaped === null));
-  assert.ok(S.goals.every((g) => g.bornOf === null && g.crit.every((c) => c.bornOf === null)));
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), true, 'the pill reveals them');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 10) }, false);
+  assert.match(p.panel(), /filed before the ledger recorded where/, 'and the panel says so, in those words');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 3) }, false);
+  assert.match(p.panel(), /from the hall/);
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 2) }, false);
+  assert.match(p.panel(), /from the command line · by a session, under your name/);
+});
+
+await test('BORN OF A THOUGHT IS READ FROM GET /sky (part 5), never guessed: the goal wears the nucleus, the ring the notch, and the thought sits where it became', async () => {
+  const sk = sky([well()]); sk.born = { goals: { 7: 10 }, criteria: { 70: 12 } };
+  const p = await boot({ mine: mine([star(), coldBody({ id: 12, title: 'It became a ring' })]), sky: sk });
+  const S = p.S(); const SKY = p.SKY(); const g = S.goalById.get('7');
+  same(S.BORN, { goals: { 7: '10' }, criteria: { 70: '12' } }, 'ids are strings whatever the wire sent');
+  assert.equal(g.bornOf, '10'); assert.equal(g.crit[0].bornOf, '12');
+  assert.equal(S.becameGoal.get('10'), '7'); assert.equal(S.becameCrit.get('12'), g.crit[0]);
+  const shaped = findIdea(p, 10); assert.equal(shaped.shaped.kind, 'goal'); assert.equal(shaped.x, g.x); assert.equal(shaped.y, g.y);
+  const ring = findIdea(p, 12); assert.equal(ring.shaped.kind, 'ring');
+  assert.ok(Math.abs(Math.hypot(ring.x - g.x, ring.y - g.y) - SKY.ringR(g, 0, 2)) < 1e-6, 'on the first ring');
+  assert.equal(SKY.became(shaped), 'a goal — it shaped the space');
+  assert.match(SKY.became(ring), /^a criterion — a ring in /);
   p.key('l');
-  assert.doesNotMatch(p.rows(), /born of a thought/);
+  assert.match(p.rows(), /shaped the space/);
+  SKY.pick({ kind: 'goal', ref: g }, false);
+  assert.match(p.panel(), /born of a thought/);
+  const none = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
+  assert.equal(none.S().becameGoal.size, 0, 'no born read, no mark — nothing is guessed');
+  assert.ok(none.S().goals.every((x) => x.bornOf === null && x.crit.every((c) => c.bornOf === null)));
 });
 
 // ═══ the bands — derived, never named by hand ════════════════════════════════

package/tests/helpers.mjs

@@ -759,15 +759,27 @@ export const settle = () => new Promise((r) => setTimeout(r, 0));
 // page keeps on `window.OTBSky.S`. Every request the page made is on
 // `requests` with its body, so a filing can be checked byte for byte against
 // what the hall form sends.
+//
+// Two doors on one page (part 4, task 1004232): thinking.html and goal-map.html
+// carry the same markup and the same scripts and differ in the body's
+// `data-sky-lens` (which lens is home). A test names the `page`; each is parsed
+// from its OWN file, so a button lost from either one fails.
 const SKY_FILES = ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js'];
 const SKY_SRC = SKY_FILES.map((f) => [f, fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', f), 'utf8')]);
-const SKY_HTML = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/thinking.html'), 'utf8');
-const SKY_BODY = (/<body[^>]*>([\s\S]*)<\/body>/.exec(SKY_HTML) || [, ''])[1].replace(/<script[\s\S]*?<\/script>/g, '');
+const SKY_PAGES = {};
+function skyPage(page) {
+  if (!SKY_PAGES[page]) {
+    const html = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', `${page}.html`), 'utf8');
+    const m = /<body([^>]*)>([\s\S]*)<\/body>/.exec(html) || [, '', ''];
+    SKY_PAGES[page] = { attrs: parseAttrs(m[1]), body: m[2].replace(/<script[\s\S]*?<\/script>/g, '') };
+  }
+  return SKY_PAGES[page];
+}
 
 export function bootSkyPage({
   mine = null, sky = null, versions = null, me = null, template = undefined,
   viewer = { id: 95, permissions: {} }, status = {}, tourSeen = true, storage = {},
-  innerWidth = 1280, innerHeight = 800, reduce = true,
+  innerWidth = 1280, innerHeight = 800, reduce = true, page = 'thinking',
 } = {}) {
   // ── the DOM ──────────────────────────────────────────────────────────────
   const windowListeners = new Map();
@@ -826,14 +838,18 @@ export function bootSkyPage({
   }
   // innerHTML on any element parses into children, so querySelectorAll('.row')
   // finds what the page just wrote and the page's own listeners get wired.
+  const { attrs: bodyAttrs, body: skyBody } = skyPage(page);
   const root = node('body', {});
+  // The body's data-* attributes are the page's dataset (data-sky-lens is what
+  // sky-data.js reads to know which lens is home).
+  for (const [k, v] of Object.entries(bodyAttrs)) if (k.startsWith('data-')) root.dataset[k.slice(5).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = v;
   const patchInnerHtml = (el) => Object.defineProperty(el, 'innerHTML', {
     get() { return this._html === null ? '' : this._html; },
     set(v) { this._html = String(v); this._value = null; parse(this, this._html); walk(this, (c) => { patchInnerHtml(c); return null; }); },
     configurable: true,
   });
   patchInnerHtml(root);
-  parse(root, SKY_BODY);
+  parse(root, skyBody);
   walk(root, (c) => { patchInnerHtml(c); return null; });
   const byId = (id) => walk(root, (c) => (c.id === id ? c : null));
   // '.brand h1' and '.jump' are the two descendant selectors the page uses.
@@ -893,7 +909,7 @@ export function bootSkyPage({
     innerWidth, innerHeight, devicePixelRatio: 1,
     matchMedia: () => ({ matches: reduce }),
     localStorage: { getItem: (k) => (k in store ? store[k] : null), setItem: (k, v) => { store[k] = String(v); } },
-    location: { hostname: 'builders.cloudbongos.com', search: '', pathname: '/thinking', hash: '', assign: (u) => { out.navigated = u; }, replace: (u) => { out.navigated = u; } },
+    location: { hostname: 'builders.cloudbongos.com', search: '', pathname: `/${page}`, hash: '', assign: (u) => { out.navigated = u; }, replace: (u) => { out.navigated = u; } },
     addEventListener: (type, fn) => { windowListeners.set(type, fn); },
     requestAnimationFrame: (fn) => { raf = fn; return 1; },
     performance: { now: () => Date.now() },

package/tests/idea_filed_via.mjs

@@ -0,0 +1,185 @@
+// tests/idea_filed_via.mjs — WHERE AN IDEA WAS FILED FROM, and WHICH THOUGHTS
+// BECAME THE STRUCTURE (task 1004233 / sky part 5 of 5, goal 1000095; ADR 0331 §4).
+//
+// The sky's prototype guessed two things from text: whether a session or a
+// person filed a thought, and which thoughts became goals or rings. This suite
+// pins the two ledger facts that replaced those guesses:
+//   - the column: additive, nullable, no default, NO BACKFILL — a row older
+//     than the column stays NULL, because NULL is not 'cli';
+//   - the vocabulary: one closed set, spelled in projection.js and mirrored by
+//     the migration's CHECK, so a bad value is a named 400 and never a 500;
+//   - each writer's value: the route reads the door off the SESSION (web is the
+//     hall, cli is the CLI, anything else the API) and lets the body add only
+//     'planning'; capture.js names 'planning' and nothing else; the Discord
+//     paths and the agents' sink name their own on the port; a new row always
+//     records a door;
+//   - the born read: first ratification wins, ids as strings, through the
+//     ideas.bornOf port so lifecycle never reads an ideas table itself.
+//
+// DB-free: captureIdea runs against a recording pool (the idea_quick_guard
+// harness), readBornOf against a fake pool, the rest is pure or read from source.
+//
+// Run:  node tests/idea_filed_via.mjs
+process.env.NODE_ENV = 'test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+const api = require(path.join(ROOT, 'src/module-api.js'));
+let queries = [];
+let nextRows = [];
+api.pool.query = async (sql, params = []) => { queries.push({ sql, params }); return { rows: nextRows }; };
+const inbox = require(path.join(ROOT, 'modules/ideas/inbox.js'));
+const projection = require(path.join(ROOT, 'modules/ideas/projection.js'));
+const { readBornOf } = require(path.join(ROOT, 'modules/ideas/born-of.js'));
+
+const { test, summary } = makeRunner();
+const reset = () => { queries = []; nextRows = [{ id: '41', title: 'an idea', status: 'open', grade: 'quick' }]; };
+const FIVE = ['hall', 'cli', 'discord', 'planning', 'api'];
+const migrationFile = fs.readdirSync(path.join(ROOT, 'migrations')).find((f) => /^core_\d+_idea_filed_via\.sql$/.test(f));
+
+// ═══ the migration ═══════════════════════════════════════════════════════════
+
+await test('the column is a CORE migration: additive, nullable, no default, and the CHECK names exactly the five doors', () => {
+  assert.ok(migrationFile, 'migrations/core_NNN_idea_filed_via.sql exists (idea_inbox is a core table — ADR 0083 §Decision #5)');
+  const sql = read(path.join('migrations', migrationFile));
+  assert.match(sql, /ALTER TABLE idea_inbox\s+ADD COLUMN IF NOT EXISTS filed_via text;/);
+  assert.equal(/filed_via text\s+(NOT NULL|DEFAULT)/i.test(sql), false, 'nullable, no default');
+  const check = /CHECK \(filed_via IS NULL OR filed_via IN \(([^)]*)\)\)/.exec(sql);
+  assert.ok(check, 'a CHECK closes the set');
+  assert.deepEqual(check[1].split(',').map((s) => s.trim().replace(/'/g, '')), FIVE);
+  assert.match(sql, /IF NOT EXISTS \(\s*SELECT 1 FROM pg_constraint/, 'the CHECK add is guarded — replay-safe');
+  assert.ok(sql.includes(`INSERT INTO schema_migrations (version) VALUES ('${migrationFile.replace(/\.sql$/, '')}')`), 'the stem is the version');
+});
+
+await test('NULL IS NOT \'cli\': the migration backfills nothing, and no writer guesses a door from text', () => {
+  const sql = read(path.join('migrations', migrationFile));
+  assert.equal(/UPDATE idea_inbox/i.test(sql), false, 'no backfill — a historic row stays NULL');
+  assert.equal(/title|body_md|ILIKE|~\*/.test(sql.replace(/^--.*$/gm, '')), false, 'nothing in the SQL reads the idea\'s words');
+  const src = read('modules/ideas/inbox.js') + read('modules/ideas/projection.js') + read('modules/ideas/routes/inbox.js');
+  assert.equal(/filed_via\s*=\s*CASE|classify\([^)]*\)\s*===?\s*'(cli|api)'/.test(src), false, 'no code derives a door from the text either');
+});
+
+// ═══ the vocabulary ══════════════════════════════════════════════════════════
+
+await test('ONE closed set, spelled in projection.js, carried by every read', () => {
+  assert.deepEqual([...projection.FILED_VIA_VALUES], FIVE);
+  assert.ok(Object.isFrozen(projection.FILED_VIA_VALUES));
+  assert.ok(projection.IDEA_COL_NAMES.includes('filed_via'), 'on the shared column list — so the trail (and GET /sky/mine, which is the trail) returns it');
+  assert.match(projection.IDEA_COLS_Q, /\bi\.filed_via\b/);
+  for (const v of FIVE) assert.equal(projection.isValidFiledVia(v), true);
+  for (const v of ['session', 'person', '', null, undefined, 'HALL']) assert.equal(projection.isValidFiledVia(v), false, `${v} is not a door`);
+  assert.deepEqual([inbox.FILED_VIA_VALUES, inbox.resolveFiledVia], [projection.FILED_VIA_VALUES, projection.resolveFiledVia], 'the facade re-exports the one declaration');
+});
+
+// ═══ the door is read off the session ════════════════════════════════════════
+
+await test('the session says which door: a web cookie is the hall, a device-flow token is the CLI, anything else is the API', () => {
+  const { filedViaForSource } = projection;
+  assert.equal(filedViaForSource('web'), 'hall');
+  assert.equal(filedViaForSource('cli'), 'cli');
+  assert.equal(filedViaForSource('box'), 'api');
+  assert.equal(filedViaForSource(null), 'api', 'a legacy sourceless session is the API, not a guess');
+  assert.equal(filedViaForSource(undefined), 'api');
+});
+
+await test('the body may ADD only \'planning\'; repeating the session\'s own door is harmless; any other claim is refused with the reason', () => {
+  const { resolveFiledVia } = projection;
+  assert.deepEqual(resolveFiledVia('cli', undefined), { ok: true, value: 'cli' });
+  assert.deepEqual(resolveFiledVia('web', null), { ok: true, value: 'hall' });
+  assert.deepEqual(resolveFiledVia('cli', 'planning'), { ok: true, value: 'planning' }, 'the planning session is a CLI filing no session can tell apart');
+  assert.deepEqual(resolveFiledVia('web', 'planning'), { ok: true, value: 'planning' });
+  assert.deepEqual(resolveFiledVia('web', 'hall'), { ok: true, value: 'hall' }, 'naming your own door changes nothing');
+  const spoof = resolveFiledVia('cli', 'hall');
+  assert.equal(spoof.ok, false, 'a CLI cannot say it came through the hall');
+  assert.deepEqual(spoof.detail.allowed, ['planning', 'cli']);
+  assert.match(spoof.detail.reason, /read off your session \(cli\)/);
+  const junk = resolveFiledVia('web', 'session');
+  assert.equal(junk.ok, false);
+  assert.match(junk.detail.reason, /must be one of hall, cli, discord, planning, api/);
+});
+
+await test('POST /inbox reads the door off req.gdsSession, refuses a bad claim as a named 400, and hands captureIdea the value', () => {
+  const src = read('modules/ideas/routes/inbox.js');
+  assert.match(src, /filed_via: \{ type: 'string', maxLength: 16 \}/, 'the body field is declared (strict validation would 400 it otherwise)');
+  assert.match(src, /inbox\.resolveFiledVia\(req\.gdsSession && req\.gdsSession\.source, body\.filed_via\)/, 'the SESSION source, never the body alone');
+  assert.match(src, /res\.fail\('bad_filed_via', 400, door\.detail\)/);
+  assert.match(src, /filedVia: door\.value,/);
+  assert.match(src, /err\.code === 'BAD_FILED_VIA' \? 400 :/, 'a value that slipped past the route is still a 400, never a constraint 500');
+});
+
+// ═══ every writer ════════════════════════════════════════════════════════════
+
+await test('captureIdea WRITES the door on the row, defaults a silent port caller to \'api\', and refuses a value outside the set', async () => {
+  reset();
+  await inbox.captureIdea({ title: 'from the bot', capturedBy: '7', filedVia: 'discord' });
+  assert.equal(queries.length, 1);
+  assert.match(queries[0].sql, /INSERT INTO idea_inbox[\s\S]*filed_via\)/, 'the column is in the INSERT');
+  assert.equal(queries[0].params.at(-1), 'discord', 'and the value is the last bind');
+  reset();
+  await inbox.captureIdea({ title: 'a program said nothing', capturedBy: null });
+  assert.equal(queries[0].params.at(-1), 'api', 'a NEW row always records a door — NULL is for rows older than the column');
+  reset();
+  await assert.rejects(inbox.captureIdea({ title: 'x', capturedBy: '7', filedVia: 'session' }), (e) => e.code === 'BAD_FILED_VIA' && e.filedVia === 'session' && Array.isArray(e.allowed));
+  assert.equal(queries.length, 0, 'refused before any write');
+});
+
+await test('the ROUTED insert (a filing that becomes a task in the same act) writes the door too', () => {
+  const src = read('modules/ideas/inbox.js');
+  const inserts = [...src.matchAll(/INSERT INTO idea_inbox[\s\S]*?RETURNING \$\{IDEA_COLS\}/g)].map((m) => m[0]);
+  assert.equal(inserts.length, 2, 'the inbox insert and the routed insert');
+  for (const ins of inserts) assert.match(ins, /filed_via/, 'both name the column');
+  assert.match(src, /capturedBy, goalId, landing, filerRank, touches, filedVia,\s*\}, activePool\)/, 'and the routed path is handed the value');
+});
+
+await test('capture.js names \'planning\' and nothing else — every other CLI filing\'s door is read off the session', () => {
+  const src = read('scripts/gds/capture.js');
+  assert.match(src, /const viaFromArg = arg\('--via', args\);/);
+  assert.match(src, /if \(viaFromArg !== null && viaFromArg !== 'planning'\)[\s\S]{0,400}process\.exit\(2\)/, 'a door the CLI may not name is refused before the request');
+  assert.match(src, /if \(viaFromArg\) payload\.filed_via = viaFromArg;/, 'sent only when given — a pinned core that predates the field never sees it');
+  assert.equal(/filed_via: 'cli'/.test(src), false, 'never claims cli — the session already says so');
+  assert.equal(/postInbox\(/.test(read('scripts/gds/spark.js')), false, 'spark.js files no idea row of its own (a spark is made from an existing idea), so its door is the row\'s');
+  assert.match(read('.claude/skills/planning-session/SKILL.md'), /--via planning/, 'the planning session is told to name its door');
+});
+
+await test('the Discord doors and the agents\' sink name their own door on the port', () => {
+  assert.match(read('modules/discord/discord-inbound.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/discord/discord-bugs.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/agents/pollers/event-router.js'), /filedVia: 'api',/);
+});
+
+// ═══ born of a thought ═══════════════════════════════════════════════════════
+
+function bornPool({ goals = [], criteria = [] } = {}) {
+  const calls = [];
+  return { calls, async query(sql) { calls.push(sql); return { rows: /ideas_goal_ratifications/.test(sql) ? goals : criteria }; } };
+}
+
+await test('readBornOf: goals from the goal ratifications, criteria from the proposal audit, the FIRST ratification wins, ids as strings', async () => {
+  const pool = bornPool({
+    goals: [{ goal_id: '7', idea_id: '10' }, { goal_id: '7', idea_id: '99' }, { goal_id: 8, idea_id: 11 }],
+    criteria: [{ criterion_id: '70', idea_id: '12' }, { criterion_id: '71', idea_id: null }],
+  });
+  const born = await readBornOf({ pool });
+  assert.deepEqual(born, { goals: { 7: '10', 8: '11' }, criteria: { 70: '12' } });
+  assert.equal(pool.calls.length, 2);
+  assert.match(pool.calls[0], /FROM ideas_goal_ratifications\s+ORDER BY ratified_at, id/);
+  assert.match(pool.calls[1], /FROM criterion_proposal_audit\s+ORDER BY ratified_at, id/);
+  assert.deepEqual(await readBornOf({ pool: bornPool() }), { goals: {}, criteria: {} }, 'nothing ratified is an empty map');
+});
+
+await test('the read is served through the ideas.bornOf port, beside ideas.capture, so lifecycle\'s GET /sky never reads an ideas table', () => {
+  assert.match(read('modules/ideas/routes/inbox.js'), /api\.registerProvider\('ideas\.bornOf', bornOf\.readBornOf\)/);
+  const sky = read('modules/lifecycle/sky.js');
+  assert.match(sky, /resolveOptional\('ideas\.bornOf'\)/);
+  assert.equal(/ideas_goal_ratifications|criterion_proposal_audit|require\(['"][^'"]*ideas/.test(sky), false);
+});
+
+console.log('');
+summary();

package/tests/landing_page.mjs

@@ -600,3 +600,11 @@ test('the chip is the profile trigger, built with createElement; Sign out is the
   assert.match(CODE, /var signout = document\.querySelector\('#menuProfile a\.signout'\);\s*if \(signout\) signout\.addEventListener\('click', function \(e\) \{ e\.preventDefault\(\); doLogout\(\); \}\);/, 'the honest href, upgraded to the POST');
   assert.doesNotMatch(CODE, /className = 'pill signout'/, 'no sign-out pill in the bar any more');
 });
+
+test('the retired gate assets (world/assets/clouds|creatures|plates) are gone — the chrome landing ships its plates from assets/world/ instead (task 1003650)', () => {
+  assert.ok(!fs.existsSync(path.join(LANDING, 'world')), 'modules/public-landing/public/world/ no longer exists');
+  assert.doesNotMatch(HTML, /\bworld\/assets\//, 'the page links no path under the retired world/assets/ folder');
+  assert.doesNotMatch(WORLD, /\bworld\/assets\//, 'world.css references no path under the retired folder');
+  // the chrome landing's own plates (task 1003298) live at assets/world/ and are untouched by this cleanup
+  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.jpg')), 'the chrome plate at assets/world/ is untouched (task 1003649 converts it separately)');
+});

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'db45ff41bd9c5fce';
+const SHELL_SHA = '9cc99bb9b7cce948';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/profile_rollup_consent.mjs

@@ -62,6 +62,7 @@ const ALL_ORIGINS = [PUB_ORIGIN, PRIV_ORIGIN, STEALTH_ORIGIN, UNREAD_ORIGIN];
 const q = (sql, params) => pool.query(sql, params);
 
 async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_project_memberships WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
@@ -81,7 +82,9 @@ try {
   // error dressed up as a boundary failure — instead of a clean assertion.
   // 011 and 020 carry the columns the naming rule reads (description, visibility,
   // the door-known pair); 012_recent_ships the column the rollup SELECTs; 008 and
-  // 009 the handle and display_name_source columns upsertAccount writes.
+  // 009 the handle and display_name_source columns upsertAccount writes; 022 is
+  // the table upsertActivity now also writes on every call (task 1002977) — step
+  // 5 below issues that INSERT, and a fresh database without it fails 42P01.
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_004_projects.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
@@ -93,6 +96,7 @@ try {
   await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await q(migrationSql('platform_identity_020_visibility_pull.sql'));
+  await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND

package/tests/project_admin_console_model.mjs

@@ -0,0 +1,105 @@
+// tests/project_admin_console_model.mjs — the project admin console model holds
+// (task 1002813, R1 of the console wave; the ADR whose filename ends in ADR_SLUG).
+//
+// The ADR decides three things and then tells three build tasks what to build on
+// them. Its decisions rest on facts about live code, and a decision whose premises
+// drift quietly is worse than none, so the load-bearing ones are pinned here:
+//
+//   D1  the hub relays and notifies; it never writes a project's admission row
+//   D2  an invite is a row the existing gate already reads — `kind` and
+//       `created_by` are descriptive and never enter the admission read
+//   D3  the admission verdict stays `access_request.review` at the archon floor,
+//       and `project.recruit`, once minted, takes exactly the shape the ADR fixes
+//
+// The ADR is found by its slug, not its number, because a parallel ADR can take
+// the number first and force a renumber (tests/adr_renumber_integrity.mjs).
+//
+// Run:  node --test --test-reporter=tap tests/project_admin_console_model.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+const ADR_SLUG = 'an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md';
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const { stripComments } = require(path.join(ROOT, 'scripts', 'gds', 'category-advisory-guard.js'));
+
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+function findAdr() {
+  const hits = fs.readdirSync(ADR_DIR).filter((f) => /^\d{4}-/.test(f) && f.endsWith(ADR_SLUG));
+  assert.equal(hits.length, 1, `exactly one ADR ends in ${ADR_SLUG}; found ${hits.length}`);
+  return hits[0];
+}
+
+function jsFilesUnder(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === 'tests') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...jsFilesUnder(full));
+    else if (entry.name.endsWith('.js')) out.push(full);
+  }
+  return out;
+}
+
+test('the ADR exists, is indexed, and ADR 0141 names it as superseding its §5 invitations note', () => {
+  const file = findAdr();
+  const index = read('docs', 'adr', 'README.md');
+  assert.ok(index.includes(`](${file})`), 'docs/adr/README.md carries an index row linking the ADR');
+
+  const status = read('docs', 'adr', '0141-cross-site-identity-federated-hub-idp.md')
+    .split(/\r?\n/)
+    .find((l) => l.startsWith('- **Status:**'));
+  assert.ok(status, 'ADR 0141 keeps a Status line');
+  assert.ok(status.includes(file), 'ADR 0141 Status line links the superseding ADR');
+  assert.match(status, /§5/, 'the supersession is partial — it names §5, not the whole of ADR 0141');
+
+  const specHead = read('docs', 'specs', 'bongos-v1-project-admin-console.md').split(/\r?\n/)[0];
+  assert.ok(specHead.includes(file), 'the spike spec sends its reader to the ADR that narrowed it');
+});
+
+// Both admission reads: the gate's own (hasInvitedAccessRequest) and the state the
+// "confirming access" waiting page polls (accessStateByLogin), which must agree with it.
+test('D2: both admission reads look at status alone — an invite and an approved application admit identically', () => {
+  const src = read('src', 'bongos', 'db-kernel.js');
+  for (const fn of ['hasInvitedAccessRequest', 'accessStateByLogin']) {
+    const m = new RegExp(`async function ${fn}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n\\}`).exec(src);
+    assert.ok(m, `${fn} is still an admission read in db-kernel.js`);
+    const body = m[1];
+    assert.match(body, /status\s*=\s*'invited'/, `${fn}: admission is status = invited`);
+    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is descriptive; it must never decide admission`);
+    assert.doesNotMatch(body, /\bcreated_by\b/, `${fn}: created_by is audit data; it must never decide admission`);
+  }
+});
+
+test('D1: no hub (platform-identity) source writes access_requests — the hub relays, it never admits', () => {
+  const writers = [];
+  for (const f of jsFilesUnder(path.join(ROOT, 'modules', 'platform-identity'))) {
+    const code = stripComments(fs.readFileSync(f, 'utf8'));
+    if (/\b(?:INSERT\s+INTO|UPDATE|DELETE\s+FROM)\s+access_requests\b/i.test(code)) {
+      writers.push(path.relative(ROOT, f));
+    }
+  }
+  assert.deepEqual(writers, [], 'a project admits on its own instance; the hub reaches it only through a relay');
+});
+
+test('D3: the verdict stays access_request.review at archon, and project.recruit takes the fixed shape', () => {
+  const review = catalog.byKey('access_request.review');
+  assert.ok(review, 'access_request.review exists');
+  assert.equal(review.floor, 'archon', 'the admission verdict stays at the archon floor');
+
+  // R3 (task 1002815) mints the atom. Until then there is nothing to check; once
+  // it lands, this is the shape the ADR fixed, so a drifted mint reds here.
+  const recruit = catalog.byKey('project.recruit');
+  if (!recruit) return;
+  assert.equal(recruit.floor, 'archon', 'the per-project invite floor defaults to archon (ADR 0217 D1)');
+  assert.equal(recruit.system, false, 'grantable, and composable into a custom rank');
+  assert.ok(!recruit.substrate, 'enforced in the app, so a grant is never inert');
+  assert.ok(recruit.principal == null, 'held by ranks, never by a machine principal');
+});

package/tests/render_check.mjs

@@ -15,19 +15,21 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const names = (paths) => statesFilesFor(paths, ROOT).map((f) => path.basename(f));
 
 test('a changed page or its own script reaches the states file beside it', () => {
-  assert.deepEqual(names(['modules/hall-ui/public/goal-map.js']), ['goal-map.states.json']);
+  assert.deepEqual(names(['modules/hall-ui/public/goals.js']), ['goals.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/goal-map.html']), ['goal-map.states.json']);
   assert.deepEqual(names(['modules/public-landing/public/projects.html']), ['projects.states.json']);
 });
 
 test('a shared asset reaches every page in its dir whose HTML names it', () => {
-  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goal-map.states.json', 'goals.states.json']);
+  // sky-data.js is shared by the two doors of one page (task 1004232): /thinking and /goal-map.
+  assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
+  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
   assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {
-  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js', 'modules/hall-ui/public/work.js']), ['work.states.json', 'goal-map.states.json', 'goals.states.json']);
-  assert.deepEqual(names(['modules/hall-ui/public/text-fit.js', 'modules/hall-ui/public/goal-map.js']), ['goal-map.states.json', 'goals.states.json'], 'a page reached both ways is listed once, as its own');
+  assert.deepEqual(names(['modules/hall-ui/public/sky-data.js', 'modules/hall-ui/public/work.js']), ['work.states.json', 'goal-map.states.json', 'thinking.states.json']);
+  assert.deepEqual(names(['modules/hall-ui/public/sky-data.js', 'modules/hall-ui/public/goal-map.html']), ['goal-map.states.json', 'thinking.states.json'], 'a page reached both ways is listed once, as its own');
 });
 
 test('a path that is not a rendered surface, or a page with no states file, reaches nothing', () => {