@bongos/core 1.19.1015 → 1.19.1016

package/modules/platform-identity/tests/platform-identity.mjs

@@ -596,6 +596,27 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
   assert.equal(pool.calls[0].params[5], 'archon');
 });
 
+await ta('upsertActivity also appends to the snapshot history (task 1002977, community spec D2) — deleting that call would leave this red', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }, { rows: [{ id: 's1', reported_at: 'T' }] }]);
+  await P.upsertActivity({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(pool.calls.length, 2, 'the rollup upsert, then the snapshot statement');
+  assert.match(pool.calls[1].text, /INSERT INTO platform_identity_activity_snapshots/);
+  assert.deepEqual(pool.calls[1].params, ['c1', 42, 100, 5, 3]);
+});
+
+await ta('upsertActivity survives a snapshot-write failure (best-effort — the application-echo.js precedent): the rollup report still succeeds', async () => {
+  const pool = {
+    calls: [],
+    query: async (text, params) => {
+      pool.calls.push({ text: String(text), params });
+      if (/INSERT INTO platform_identity_activity_snapshots/.test(text)) throw new Error('relation "platform_identity_activity_snapshots" does not exist');
+      return { rows: [{ id: '1' }] };
+    },
+  };
+  const out = await P.upsertActivity({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(out.id, '1', 'the rollup upsert result still returns despite the snapshot write throwing');
+});
+
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
   const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member', signin_verified_at: 'T' };
   const pool = mockPool([{ rows: [row] }]);

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -42,7 +42,7 @@ What changed in translation, on purpose. The method's **three persisted homes**
 Read four live signals, then print two or three recommended next commands with a one-line reason each, followed by the full list grouped by category. Signals, all read locally and none written:
 
 1. **The world files**: does `DESIGN.md` exist at the repo root; is `config/branding.json` present over the neutral pack; is `docs/project-context.template.md` filled or still the scaffold. A scaffold with no answers recommends `shape` first; a missing `DESIGN.md` alone does not make the project greenfield (the neutral pack is the world).
-2. **The last kit report** for the target, if any: `report.json` under `%TMP%/ui-design-kit/<surface>/<page>/` (or the `--out` dir the last run named). Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
+2. **The last kit report** for the target, if any: `report.json` under the `--out` dir the last `render.js` run named — pass one explicitly on a shared machine, since the un-named default falls back to a world-readable OS temp dir (`os.tmpdir()`'s `ui-design-kit/<surface>/<page>/`: `%TMP%` on Windows, `$TMPDIR` on mac/linux). This is only ever read to shape the printed suggestion below, never trusted as authority. Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
 3. **Dirty files in version control**: `git status --porcelain` over the surfaces (`modules/*/public/`, `src/ui/`, `public*/`). Dirty UI files recommend `polish` on that path before anything new.
 4. **A stub already listening**: `kit/serve.js` prints its port when it starts; a page already served means the live loop (the playwright plugin) is available without a second server. Never start a duplicate on an occupied port.
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1015",
+  "version": "1.19.1016",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1015",
+      "version": "1.19.1016",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1015",
+  "version": "1.19.1016",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/capture.js

@@ -269,6 +269,7 @@ async function main() {
     console.error('       ... [--spark]                       offer it up for someone else to develop');
     console.error('       ... [--full --fields-file f.json]   file a Full Idea (five fields; see spark.js --template)');
     console.error('       ... [--no-prompt]                   never ask anything (default when not a terminal)');
+    console.error('       ... [--via planning]                a planning session\'s capture — the sky records the door (task 1004233)');
     process.exit(2);
   }
 
@@ -281,6 +282,15 @@ async function main() {
   const fieldsFile = arg('--fields-file', args);
   const noPrompt = hasFlag('--no-prompt', args);
   const goalArg = arg('--goal', args);
+  // task 1004233 (sky part 5): WHICH DOOR. The server reads 'cli' off this
+  // session's token, so this CLI names nothing — except a planning session's
+  // capture, which no session can tell from any other CLI filing. Only that one
+  // value is accepted here; the server refuses every other claim the same way.
+  const viaFromArg = arg('--via', args);
+  if (viaFromArg !== null && viaFromArg !== 'planning') {
+    console.error(`--via "${viaFromArg}" is not a door this CLI may name. Where a filing came from is read off your session; the one value you may add is --via planning.`);
+    process.exit(2);
+  }
 
   // A BAD --kind used to reach the server and come back a 400 (task 1003694).
   // That is not merely late, it is invisible where it matters: a SCHEDULED routine
@@ -376,6 +386,7 @@ async function main() {
     suggested_priority: priority,
   };
   if (kindFromArg) payload.kind = kindFromArg;
+  if (viaFromArg) payload.filed_via = viaFromArg;
   if (goalResolution.goalId != null) payload.goal_id = goalResolution.goalId;
   if (wantFull) {
     // The server validates these against the R141 declaration and scores them

package/scripts/gds/run-unit-tests.js

@@ -83,6 +83,10 @@ const INTEGRATION = new Set([
   // rows is NULL rather than a free ship. Only a transaction engine settles
   // those, so this runs here and the DB-free sibling covers the renderer.
   'acclaim_feed_evidence_db',
+  // task 1002977: proves the changed-totals skip rule (a single INSERT ...
+  // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
+  // a fake pool can prove the query shape but not which reports it inserts.
+  'activity_snapshots_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1015'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1016'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/activity_snapshots_db.mjs

@@ -0,0 +1,97 @@
+// tests/activity_snapshots_db.mjs — task 1002977 (community spec D2; real DB).
+//
+// Proves the windowed data plane's append-only history against real SQL. The
+// skip-on-unchanged rule lives entirely inside one INSERT ... WHERE NOT EXISTS
+// statement (activity-snapshots.js), so a fake pool can only prove the query
+// SHAPE (modules/platform-identity/tests/activity-snapshots.mjs); only a real
+// Postgres can prove WHICH reports it actually inserts, and that upsertActivity
+// (the existing POST /sso/activity/rollup path) really calls it end to end.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_snapshots_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { recordActivitySnapshot } = require('../modules/platform-identity/activity-snapshots.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_snapshots_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const BUILDER = 90002977, OTHER_BUILDER = 90002978;
+const IDS = [BUILDER, OTHER_BUILDER];
+const CLIENT = 't1002977-client';
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  // upsertActivity's INSERT always names recent_ships (012_recent_ships adds the
+  // column); without it here, step 2 below fails 42703 on a fresh database.
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  await cleanup();
+
+  // 1 — recordActivitySnapshot directly: the changed-totals skip rule.
+  const first = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(first !== null, 'a first-ever report inserts — nothing to be unchanged from');
+
+  const unchanged = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(unchanged === null, 'an identical re-report inserts nothing');
+
+  const changed = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 150, tasksShipped: 5, karma: 3 }, { pool });
+  ok(changed !== null, 'a changed report (credits differ) inserts a new row');
+
+  const { rows: history } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, BUILDER],
+  );
+  ok(history.length === 2, 'exactly two rows exist — the unchanged report left no trace');
+  assert.deepEqual(history.map((r) => r.credits), [100, 150]);
+  pass++; console.log('  ok - the history is in report order');
+
+  // 2 — upsertActivity (the real POST /sso/activity/rollup path) really calls it.
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 20, tasksShipped: 1, karma: 0 }, { pool });
+  const { rows: viaRollup } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, OTHER_BUILDER],
+  );
+  ok(viaRollup.length === 2, 'upsertActivity appends a snapshot per changed report — two calls, one repeat, one row skipped');
+  assert.deepEqual(viaRollup.map((r) => r.credits), [10, 20]);
+  pass++; console.log('  ok - deleting the call inside upsertActivity would leave this red');
+
+  console.log(`\nactivity_snapshots_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/discord_bugs.mjs

@@ -115,6 +115,7 @@ await t('recordInboundBug: linked Metic → filed at ready, kind=bug, attributed
   assert.equal(calls.create[0].kind, 'bug', 'the channel IS the classification');
   assert.equal(calls.create[0].filerRank, 'metic', 'the LIVE rank is handed to the matrix');
   assert.equal(calls.create[0].capturedBy, 9, 'and the reporter is attached to the capture');
+  assert.equal(calls.create[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233)');
   assert.equal(calls.create[0].goalId, 7, 'the suggester found it a home');
   // task 1003067: no versionId is passed AT ALL. It used to be the hardcoded
   // 'GDS-V3' — a shipped version, which is idea 1000771. The goal carries it now.

package/tests/discord_inbound.mjs

@@ -83,6 +83,7 @@ await t('recordInboundIdea: linked author → idea attributed to builder + audit
   assert.equal(r.outcome, 'filed');
   assert.equal(r.ideaId, 77);
   assert.equal(calls.capture[0].capturedBy, 9);
+  assert.equal(calls.capture[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233): this path calls the port, so it names it');
   assert.match(calls.capture[0].bodyMd, /filed from Discord #ideas by mona/);
   assert.equal(calls.audit[0].surface, 'discord_bot');
   assert.equal(calls.audit[0].builderId, 9);

package/tests/goal_map_page.mjs

@@ -354,6 +354,20 @@ await test('the tour walks all three lenses here too, and hands the sky back to
   assert.equal(first.timers.pending(), 1, 'a first visit schedules the tour here as well');
 });
 
+// ═══ born of a thought (part 5) ══════════════════════════════════════════════
+
+await test('a well born of a thought wears it in the ledger and the panel — the fact from GET /sky\'s born, never a guess', async () => {
+  const sk = FOUR(); sk.born = { goals: { 9: 21 }, criteria: {} };
+  const p = await boot({ sky: sk, versions: versions() });
+  assert.equal(goal(p, '9').bornOf, '21');
+  assert.equal(goal(p, '7').bornOf, null);
+  p.key('l');
+  const row = (new RegExp('data-id="9"[\\s\\S]*?</button>').exec(p.rows()) || [''])[0];
+  assert.match(row, /born of a thought/);
+  p.SKY().pick({ kind: 'goal', ref: goal(p, '9') }, false);
+  assert.match(p.panel(), /born of a thought/);
+});
+
 // ═══ the words are never markup ══════════════════════════════════════════════
 
 await test('a goal title never becomes markup — in the ledger, the panel or the hover card', async () => {

package/tests/guild_namespace_reserved.mjs

@@ -0,0 +1,76 @@
+// tests/guild_namespace_reserved.mjs — the guild URL namespace is RESERVED where
+// project slugs are decided (task 1002299, R23 guild design; task 1002912's rule).
+//
+// Project profiles live at the top level (`cloudbongos.com/<slug>`), so every
+// top-level segment the hub uses for another kind of page must be on the reserved
+// project-slug list in the SEO spec, or a project can register the word and shadow
+// the namespace. `u` guards `/u/<handle>`; the guild design names its own segment,
+// and task 1002912 asked for the word to be reserved there, not a route squatted.
+//
+// No slug validator exists yet (the SEO goal's R02 builds it from that list), so the
+// spec IS the contract today. This pins the one property that can drift silently:
+// the segment the guild ADR declares and the segment the spec reserves are the same.
+//
+// Run:  node tests/guild_namespace_reserved.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+const SEO_SPEC = path.join(ROOT, 'docs', 'specs', 'bongos-v1-seo-public-discoverability.md');
+const GUILD_TASK = '1002299';
+
+const { test, summary } = makeRunner();
+
+// The guild design ADR, found by the task it records rather than by number: ADR
+// numbers get renumbered when two sessions collide, the task id never changes.
+function guildAdr() {
+  const hits = fs.readdirSync(ADR_DIR)
+    .filter((f) => /^\d{4}-.*\.md$/.test(f))
+    .filter((f) => {
+      const head = fs.readFileSync(path.join(ADR_DIR, f), 'utf8').replace(/\r\n/g, '\n').split('\n').slice(0, 12).join('\n');
+      return new RegExp(`^- \\*\\*Task:\\*\\*.*task ${GUILD_TASK}\\b`, 'm').test(head);
+    });
+  assert.equal(hits.length, 1, `exactly one ADR records task ${GUILD_TASK}; found ${JSON.stringify(hits)}`);
+  return fs.readFileSync(path.join(ADR_DIR, hits[0]), 'utf8').replace(/\r\n/g, '\n');
+}
+
+// The segment the ADR declares on its machine-readable `Namespace:` line.
+function declaredSegment(adr) {
+  const m = adr.match(/^- \*\*Namespace:\*\* `\/([a-z0-9-]+)\/<slug>`/m);
+  assert.ok(m, 'the guild ADR carries a `- **Namespace:** `/<segment>/<slug>`` header line');
+  return m[1];
+}
+
+// The reserved words in the SEO spec's Routing bullet: the backticked list after "Reserved:".
+function reservedWords() {
+  const spec = fs.readFileSync(SEO_SPEC, 'utf8').replace(/\r\n/g, '\n');
+  const routing = spec.split('\n').find((l) => l.startsWith('- **Routing:**'));
+  assert.ok(routing, 'the SEO spec still has its Routing bullet');
+  const m = routing.match(/Reserved: `([^`]+)`/);
+  assert.ok(m, 'the Routing bullet still names its reserved list as `Reserved: `…``');
+  return m[1].split(',').map((w) => w.trim()).filter(Boolean);
+}
+
+await test('the guild ADR declares one top-level namespace segment', () => {
+  const seg = declaredSegment(guildAdr());
+  assert.match(seg, /^[a-z0-9-]+$/);
+});
+
+await test('the SEO spec reserves the segment the guild ADR declares', () => {
+  const seg = declaredSegment(guildAdr());
+  const reserved = reservedWords();
+  assert.ok(reserved.includes(seg),
+    `a project could register "${seg}" and shadow /${seg}/<slug>; reserved list is ${JSON.stringify(reserved)}`);
+});
+
+await test('the builder-profile segment it was modelled on is still reserved', () => {
+  // The precedent the task names. If `u` ever leaves the list, the guild reservation
+  // above has lost the rule it was copied from, and both need a second look.
+  assert.ok(reservedWords().includes('u'));
+});
+
+summary();

package/tests/hall_sky.mjs

@@ -303,27 +303,44 @@ await test('the claude layer is HIDDEN until filed_via exists, and every thought
   assert.ok(p.S().ideas.every((i) => i.origin === 'human'));
 });
 
-await test('once filed_via is on a row the pill appears, that thought waits behind it, and historic rows still show', async () => {
-  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'session' }), idea({ id: 3, title: 'A person filed this', filed_via: 'person' })]) });
+await test('filed_via IS A LEDGER FACT (part 5): cli / api / discord wait behind the claude layer, hall / planning always show, and a row from before the column shows and says so', async () => {
+  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'cli' }), idea({ id: 3, title: 'A person filed this', filed_via: 'hall' }), idea({ id: 4, title: 'Planned', filed_via: 'planning' }), idea({ id: 5, title: 'A poller filed this', filed_via: 'api' }), idea({ id: 6, title: 'From Discord', filed_via: 'discord' })]), sky: sky([well()]) });
   assert.equal(p.S().hasFiledVia, true);
   assert.equal(p.el('claudeBtn').hidden, false);
   const SKY = p.SKY();
-  assert.equal(SKY.inLayer(findIdea(p, 2)), false, 'off by default: only what a person filed');
-  assert.equal(SKY.inLayer(findIdea(p, 10)), true, 'a historic row with no filed_via shows (the owner\'s rule)');
-  assert.equal(SKY.inLayer(findIdea(p, 3)), true);
+  same(SKY.SESSION_VIAS, ['cli', 'api', 'discord'], 'the doors a session files through');
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), false, `${id} waits behind the pill — off by default`);
+  for (const id of [10, 3, 4]) assert.equal(SKY.inLayer(findIdea(p, id)), true, `${id} shows`);
+  assert.equal(findIdea(p, 10).filedVia, null, 'a historic row carries NULL, not a guess');
   p.click('claudeBtn');
-  assert.equal(SKY.inLayer(findIdea(p, 2)), true, 'the pill reveals it');
-});
-
-await test('NO BORN-OF MARK IS DRAWN — the read does not exist yet, so nothing is guessed', async () => {
-  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
-  const S = p.S();
-  assert.equal(S.becameGoal.size, 0);
-  assert.equal(S.becameCrit.size, 0);
-  assert.ok(S.ideas.every((i) => i.shaped === null));
-  assert.ok(S.goals.every((g) => g.bornOf === null && g.crit.every((c) => c.bornOf === null)));
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), true, 'the pill reveals them');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 10) }, false);
+  assert.match(p.panel(), /filed before the ledger recorded where/, 'and the panel says so, in those words');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 3) }, false);
+  assert.match(p.panel(), /from the hall/);
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 2) }, false);
+  assert.match(p.panel(), /from the command line · by a session, under your name/);
+});
+
+await test('BORN OF A THOUGHT IS READ FROM GET /sky (part 5), never guessed: the goal wears the nucleus, the ring the notch, and the thought sits where it became', async () => {
+  const sk = sky([well()]); sk.born = { goals: { 7: 10 }, criteria: { 70: 12 } };
+  const p = await boot({ mine: mine([star(), coldBody({ id: 12, title: 'It became a ring' })]), sky: sk });
+  const S = p.S(); const SKY = p.SKY(); const g = S.goalById.get('7');
+  same(S.BORN, { goals: { 7: '10' }, criteria: { 70: '12' } }, 'ids are strings whatever the wire sent');
+  assert.equal(g.bornOf, '10'); assert.equal(g.crit[0].bornOf, '12');
+  assert.equal(S.becameGoal.get('10'), '7'); assert.equal(S.becameCrit.get('12'), g.crit[0]);
+  const shaped = findIdea(p, 10); assert.equal(shaped.shaped.kind, 'goal'); assert.equal(shaped.x, g.x); assert.equal(shaped.y, g.y);
+  const ring = findIdea(p, 12); assert.equal(ring.shaped.kind, 'ring');
+  assert.ok(Math.abs(Math.hypot(ring.x - g.x, ring.y - g.y) - SKY.ringR(g, 0, 2)) < 1e-6, 'on the first ring');
+  assert.equal(SKY.became(shaped), 'a goal — it shaped the space');
+  assert.match(SKY.became(ring), /^a criterion — a ring in /);
   p.key('l');
-  assert.doesNotMatch(p.rows(), /born of a thought/);
+  assert.match(p.rows(), /shaped the space/);
+  SKY.pick({ kind: 'goal', ref: g }, false);
+  assert.match(p.panel(), /born of a thought/);
+  const none = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
+  assert.equal(none.S().becameGoal.size, 0, 'no born read, no mark — nothing is guessed');
+  assert.ok(none.S().goals.every((x) => x.bornOf === null && x.crit.every((c) => c.bornOf === null)));
 });
 
 // ═══ the bands — derived, never named by hand ════════════════════════════════

package/tests/idea_filed_via.mjs

@@ -0,0 +1,185 @@
+// tests/idea_filed_via.mjs — WHERE AN IDEA WAS FILED FROM, and WHICH THOUGHTS
+// BECAME THE STRUCTURE (task 1004233 / sky part 5 of 5, goal 1000095; ADR 0331 §4).
+//
+// The sky's prototype guessed two things from text: whether a session or a
+// person filed a thought, and which thoughts became goals or rings. This suite
+// pins the two ledger facts that replaced those guesses:
+//   - the column: additive, nullable, no default, NO BACKFILL — a row older
+//     than the column stays NULL, because NULL is not 'cli';
+//   - the vocabulary: one closed set, spelled in projection.js and mirrored by
+//     the migration's CHECK, so a bad value is a named 400 and never a 500;
+//   - each writer's value: the route reads the door off the SESSION (web is the
+//     hall, cli is the CLI, anything else the API) and lets the body add only
+//     'planning'; capture.js names 'planning' and nothing else; the Discord
+//     paths and the agents' sink name their own on the port; a new row always
+//     records a door;
+//   - the born read: first ratification wins, ids as strings, through the
+//     ideas.bornOf port so lifecycle never reads an ideas table itself.
+//
+// DB-free: captureIdea runs against a recording pool (the idea_quick_guard
+// harness), readBornOf against a fake pool, the rest is pure or read from source.
+//
+// Run:  node tests/idea_filed_via.mjs
+process.env.NODE_ENV = 'test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+const api = require(path.join(ROOT, 'src/module-api.js'));
+let queries = [];
+let nextRows = [];
+api.pool.query = async (sql, params = []) => { queries.push({ sql, params }); return { rows: nextRows }; };
+const inbox = require(path.join(ROOT, 'modules/ideas/inbox.js'));
+const projection = require(path.join(ROOT, 'modules/ideas/projection.js'));
+const { readBornOf } = require(path.join(ROOT, 'modules/ideas/born-of.js'));
+
+const { test, summary } = makeRunner();
+const reset = () => { queries = []; nextRows = [{ id: '41', title: 'an idea', status: 'open', grade: 'quick' }]; };
+const FIVE = ['hall', 'cli', 'discord', 'planning', 'api'];
+const migrationFile = fs.readdirSync(path.join(ROOT, 'migrations')).find((f) => /^core_\d+_idea_filed_via\.sql$/.test(f));
+
+// ═══ the migration ═══════════════════════════════════════════════════════════
+
+await test('the column is a CORE migration: additive, nullable, no default, and the CHECK names exactly the five doors', () => {
+  assert.ok(migrationFile, 'migrations/core_NNN_idea_filed_via.sql exists (idea_inbox is a core table — ADR 0083 §Decision #5)');
+  const sql = read(path.join('migrations', migrationFile));
+  assert.match(sql, /ALTER TABLE idea_inbox\s+ADD COLUMN IF NOT EXISTS filed_via text;/);
+  assert.equal(/filed_via text\s+(NOT NULL|DEFAULT)/i.test(sql), false, 'nullable, no default');
+  const check = /CHECK \(filed_via IS NULL OR filed_via IN \(([^)]*)\)\)/.exec(sql);
+  assert.ok(check, 'a CHECK closes the set');
+  assert.deepEqual(check[1].split(',').map((s) => s.trim().replace(/'/g, '')), FIVE);
+  assert.match(sql, /IF NOT EXISTS \(\s*SELECT 1 FROM pg_constraint/, 'the CHECK add is guarded — replay-safe');
+  assert.ok(sql.includes(`INSERT INTO schema_migrations (version) VALUES ('${migrationFile.replace(/\.sql$/, '')}')`), 'the stem is the version');
+});
+
+await test('NULL IS NOT \'cli\': the migration backfills nothing, and no writer guesses a door from text', () => {
+  const sql = read(path.join('migrations', migrationFile));
+  assert.equal(/UPDATE idea_inbox/i.test(sql), false, 'no backfill — a historic row stays NULL');
+  assert.equal(/title|body_md|ILIKE|~\*/.test(sql.replace(/^--.*$/gm, '')), false, 'nothing in the SQL reads the idea\'s words');
+  const src = read('modules/ideas/inbox.js') + read('modules/ideas/projection.js') + read('modules/ideas/routes/inbox.js');
+  assert.equal(/filed_via\s*=\s*CASE|classify\([^)]*\)\s*===?\s*'(cli|api)'/.test(src), false, 'no code derives a door from the text either');
+});
+
+// ═══ the vocabulary ══════════════════════════════════════════════════════════
+
+await test('ONE closed set, spelled in projection.js, carried by every read', () => {
+  assert.deepEqual([...projection.FILED_VIA_VALUES], FIVE);
+  assert.ok(Object.isFrozen(projection.FILED_VIA_VALUES));
+  assert.ok(projection.IDEA_COL_NAMES.includes('filed_via'), 'on the shared column list — so the trail (and GET /sky/mine, which is the trail) returns it');
+  assert.match(projection.IDEA_COLS_Q, /\bi\.filed_via\b/);
+  for (const v of FIVE) assert.equal(projection.isValidFiledVia(v), true);
+  for (const v of ['session', 'person', '', null, undefined, 'HALL']) assert.equal(projection.isValidFiledVia(v), false, `${v} is not a door`);
+  assert.deepEqual([inbox.FILED_VIA_VALUES, inbox.resolveFiledVia], [projection.FILED_VIA_VALUES, projection.resolveFiledVia], 'the facade re-exports the one declaration');
+});
+
+// ═══ the door is read off the session ════════════════════════════════════════
+
+await test('the session says which door: a web cookie is the hall, a device-flow token is the CLI, anything else is the API', () => {
+  const { filedViaForSource } = projection;
+  assert.equal(filedViaForSource('web'), 'hall');
+  assert.equal(filedViaForSource('cli'), 'cli');
+  assert.equal(filedViaForSource('box'), 'api');
+  assert.equal(filedViaForSource(null), 'api', 'a legacy sourceless session is the API, not a guess');
+  assert.equal(filedViaForSource(undefined), 'api');
+});
+
+await test('the body may ADD only \'planning\'; repeating the session\'s own door is harmless; any other claim is refused with the reason', () => {
+  const { resolveFiledVia } = projection;
+  assert.deepEqual(resolveFiledVia('cli', undefined), { ok: true, value: 'cli' });
+  assert.deepEqual(resolveFiledVia('web', null), { ok: true, value: 'hall' });
+  assert.deepEqual(resolveFiledVia('cli', 'planning'), { ok: true, value: 'planning' }, 'the planning session is a CLI filing no session can tell apart');
+  assert.deepEqual(resolveFiledVia('web', 'planning'), { ok: true, value: 'planning' });
+  assert.deepEqual(resolveFiledVia('web', 'hall'), { ok: true, value: 'hall' }, 'naming your own door changes nothing');
+  const spoof = resolveFiledVia('cli', 'hall');
+  assert.equal(spoof.ok, false, 'a CLI cannot say it came through the hall');
+  assert.deepEqual(spoof.detail.allowed, ['planning', 'cli']);
+  assert.match(spoof.detail.reason, /read off your session \(cli\)/);
+  const junk = resolveFiledVia('web', 'session');
+  assert.equal(junk.ok, false);
+  assert.match(junk.detail.reason, /must be one of hall, cli, discord, planning, api/);
+});
+
+await test('POST /inbox reads the door off req.gdsSession, refuses a bad claim as a named 400, and hands captureIdea the value', () => {
+  const src = read('modules/ideas/routes/inbox.js');
+  assert.match(src, /filed_via: \{ type: 'string', maxLength: 16 \}/, 'the body field is declared (strict validation would 400 it otherwise)');
+  assert.match(src, /inbox\.resolveFiledVia\(req\.gdsSession && req\.gdsSession\.source, body\.filed_via\)/, 'the SESSION source, never the body alone');
+  assert.match(src, /res\.fail\('bad_filed_via', 400, door\.detail\)/);
+  assert.match(src, /filedVia: door\.value,/);
+  assert.match(src, /err\.code === 'BAD_FILED_VIA' \? 400 :/, 'a value that slipped past the route is still a 400, never a constraint 500');
+});
+
+// ═══ every writer ════════════════════════════════════════════════════════════
+
+await test('captureIdea WRITES the door on the row, defaults a silent port caller to \'api\', and refuses a value outside the set', async () => {
+  reset();
+  await inbox.captureIdea({ title: 'from the bot', capturedBy: '7', filedVia: 'discord' });
+  assert.equal(queries.length, 1);
+  assert.match(queries[0].sql, /INSERT INTO idea_inbox[\s\S]*filed_via\)/, 'the column is in the INSERT');
+  assert.equal(queries[0].params.at(-1), 'discord', 'and the value is the last bind');
+  reset();
+  await inbox.captureIdea({ title: 'a program said nothing', capturedBy: null });
+  assert.equal(queries[0].params.at(-1), 'api', 'a NEW row always records a door — NULL is for rows older than the column');
+  reset();
+  await assert.rejects(inbox.captureIdea({ title: 'x', capturedBy: '7', filedVia: 'session' }), (e) => e.code === 'BAD_FILED_VIA' && e.filedVia === 'session' && Array.isArray(e.allowed));
+  assert.equal(queries.length, 0, 'refused before any write');
+});
+
+await test('the ROUTED insert (a filing that becomes a task in the same act) writes the door too', () => {
+  const src = read('modules/ideas/inbox.js');
+  const inserts = [...src.matchAll(/INSERT INTO idea_inbox[\s\S]*?RETURNING \$\{IDEA_COLS\}/g)].map((m) => m[0]);
+  assert.equal(inserts.length, 2, 'the inbox insert and the routed insert');
+  for (const ins of inserts) assert.match(ins, /filed_via/, 'both name the column');
+  assert.match(src, /capturedBy, goalId, landing, filerRank, touches, filedVia,\s*\}, activePool\)/, 'and the routed path is handed the value');
+});
+
+await test('capture.js names \'planning\' and nothing else — every other CLI filing\'s door is read off the session', () => {
+  const src = read('scripts/gds/capture.js');
+  assert.match(src, /const viaFromArg = arg\('--via', args\);/);
+  assert.match(src, /if \(viaFromArg !== null && viaFromArg !== 'planning'\)[\s\S]{0,400}process\.exit\(2\)/, 'a door the CLI may not name is refused before the request');
+  assert.match(src, /if \(viaFromArg\) payload\.filed_via = viaFromArg;/, 'sent only when given — a pinned core that predates the field never sees it');
+  assert.equal(/filed_via: 'cli'/.test(src), false, 'never claims cli — the session already says so');
+  assert.equal(/postInbox\(/.test(read('scripts/gds/spark.js')), false, 'spark.js files no idea row of its own (a spark is made from an existing idea), so its door is the row\'s');
+  assert.match(read('.claude/skills/planning-session/SKILL.md'), /--via planning/, 'the planning session is told to name its door');
+});
+
+await test('the Discord doors and the agents\' sink name their own door on the port', () => {
+  assert.match(read('modules/discord/discord-inbound.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/discord/discord-bugs.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/agents/pollers/event-router.js'), /filedVia: 'api',/);
+});
+
+// ═══ born of a thought ═══════════════════════════════════════════════════════
+
+function bornPool({ goals = [], criteria = [] } = {}) {
+  const calls = [];
+  return { calls, async query(sql) { calls.push(sql); return { rows: /ideas_goal_ratifications/.test(sql) ? goals : criteria }; } };
+}
+
+await test('readBornOf: goals from the goal ratifications, criteria from the proposal audit, the FIRST ratification wins, ids as strings', async () => {
+  const pool = bornPool({
+    goals: [{ goal_id: '7', idea_id: '10' }, { goal_id: '7', idea_id: '99' }, { goal_id: 8, idea_id: 11 }],
+    criteria: [{ criterion_id: '70', idea_id: '12' }, { criterion_id: '71', idea_id: null }],
+  });
+  const born = await readBornOf({ pool });
+  assert.deepEqual(born, { goals: { 7: '10', 8: '11' }, criteria: { 70: '12' } });
+  assert.equal(pool.calls.length, 2);
+  assert.match(pool.calls[0], /FROM ideas_goal_ratifications\s+ORDER BY ratified_at, id/);
+  assert.match(pool.calls[1], /FROM criterion_proposal_audit\s+ORDER BY ratified_at, id/);
+  assert.deepEqual(await readBornOf({ pool: bornPool() }), { goals: {}, criteria: {} }, 'nothing ratified is an empty map');
+});
+
+await test('the read is served through the ideas.bornOf port, beside ideas.capture, so lifecycle\'s GET /sky never reads an ideas table', () => {
+  assert.match(read('modules/ideas/routes/inbox.js'), /api\.registerProvider\('ideas\.bornOf', bornOf\.readBornOf\)/);
+  const sky = read('modules/lifecycle/sky.js');
+  assert.match(sky, /resolveOptional\('ideas\.bornOf'\)/);
+  assert.equal(/ideas_goal_ratifications|criterion_proposal_audit|require\(['"][^'"]*ideas/.test(sky), false);
+});
+
+console.log('');
+summary();

package/tests/landing_page.mjs

@@ -600,3 +600,11 @@ test('the chip is the profile trigger, built with createElement; Sign out is the
   assert.match(CODE, /var signout = document\.querySelector\('#menuProfile a\.signout'\);\s*if \(signout\) signout\.addEventListener\('click', function \(e\) \{ e\.preventDefault\(\); doLogout\(\); \}\);/, 'the honest href, upgraded to the POST');
   assert.doesNotMatch(CODE, /className = 'pill signout'/, 'no sign-out pill in the bar any more');
 });
+
+test('the retired gate assets (world/assets/clouds|creatures|plates) are gone — the chrome landing ships its plates from assets/world/ instead (task 1003650)', () => {
+  assert.ok(!fs.existsSync(path.join(LANDING, 'world')), 'modules/public-landing/public/world/ no longer exists');
+  assert.doesNotMatch(HTML, /\bworld\/assets\//, 'the page links no path under the retired world/assets/ folder');
+  assert.doesNotMatch(WORLD, /\bworld\/assets\//, 'world.css references no path under the retired folder');
+  // the chrome landing's own plates (task 1003298) live at assets/world/ and are untouched by this cleanup
+  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.jpg')), 'the chrome plate at assets/world/ is untouched (task 1003649 converts it separately)');
+});