@bongos/core 1.19.1038 → 1.19.1040

package/scripts/gds/ship-land.js

@@ -291,7 +291,17 @@ function strandNextStep(taskId, via) {
 // task 1003764: `red` — the PR was RED on the poll's last read. "NOT a failure" is then
 // false: a required check that failed does not pass by waiting, so the banner says the
 // land is stuck on it and defers to the red lines above for the remedy.
-function landPendingLines(taskId, { merged, red } = {}) {
+function landPendingLines(taskId, { merged, red, notStarted } = {}) {
+  // task 1004289: CI never RAN (the account cannot run Actions). Not a failure of the
+  // work, and not something waiting fixes either: the checks have to be started again.
+  if (notStarted) {
+    return [
+      '  ci-land: Published, but CI never started on the PR (GitHub ran none of its checks), so it has NOT merged',
+      '  and cannot until they run. The task stays at \'confirmed\'. Nothing in the work needs to change: once the',
+      `  owner restores GitHub Actions, re-run the failed jobs (lines above), then re-run \`node scripts/gds/ship.js ${taskId}\``,
+      '  to watch the land — it resumes from here (task 941).',
+    ];
+  }
   if (red) {
     return [
       '  ci-land: Published, but the PR is RED (the check named above), so it has NOT merged and will not',
@@ -314,8 +324,9 @@ function printLandPending(taskId, opts = {}) {
   console.log('');
   for (const line of landPendingLines(taskId, opts)) console.log(line);
   // The land_pending card says there is nothing to do, which a red PR makes untrue; the
-  // red line already printed the failing_check card (task 1003764).
-  if (!opts.red) for (const line of plainCardLines('land_pending')) console.log(line);
+  // red line already printed the failing_check card (task 1003764), or the
+  // ci_not_started one (task 1004289).
+  if (!opts.red && !opts.notStarted) for (const line of plainCardLines('land_pending')) console.log(line);
 }
 
 // task 1002645 — the honest close-out when the PR MERGED but the server refused the
@@ -351,6 +362,11 @@ function prAssigneeLine(login) {
 // exported so the wording is pinned by tests/unit_report_status.mjs.
 function redPrLine(md) {
   const reason = (md && md.reason) || '';
+  if (md && md.not_started) {
+    const job = (/^ci_not_started:(.+)$/.exec(reason) || [])[1];
+    return `  ci-land: CI NEVER RAN on this PR — GitHub did not start ${job ? `the \`${job}\` job` : 'its checks'} ("The job was not started because …", `
+      + 'an Actions budget or billing stop on the account). Nothing in the work was tested, so there is nothing in it to fix.';
+  }
   const fix = 'fix it, commit, and re-run the ship — re-pushing unchanged work cannot turn it green.';
   if (md && md.failing_tests) {
     return `  ci-land: the PR is RED — ${md.failing_tests}. Reproduce with \`node tests/<name>.mjs\`, ${fix}`;
@@ -369,9 +385,21 @@ function redPrLine(md) {
 // task 1003764: the merge trap sits between them. `opts` = { taskId, via } for its wording.
 function redPrLines(md, opts = {}) {
   const red = redPrLine(md);
+  if (red && md.not_started) return [red, ...notStartedLines(md), ...plainCardLines('ci_not_started')];
   return red ? [red, ...mergeTrapLines(md, opts), ...plainCardLines((md && md.reason) || 'failing_check')] : [];
 }
 
+// notStartedLines — task 1004289. What to do when CI never ran, instead of the merge trap
+// (there is no failure to reproduce). Re-running is the remedy, not re-pushing: the same
+// commit is fine, it simply was never tested. Pure + exported.
+function notStartedLines(md) {
+  const rerun = md && /^\d+$/.test(String(md.run_id || '')) ? `\`gh run rerun ${md.run_id} --failed\`` : '"Re-run failed jobs" on the PR';
+  return [
+    '  ci-land: this is the repo OWNER\'s to fix, on GitHub: the account\'s Actions budget / spending limit or payment method.',
+    `  ci-land: once Actions can run again, ${rerun} starts the checks on the SAME commit — do not re-push or edit the work.`,
+  ];
+}
+
 // The unit tests that gate GENERATED files — each compares a committed artifact with a
 // fresh build of it. `fitness` holds the combined gate (fitness.js "generated artifacts
 // fresh": copy registry, API docs, file map, nested CLAUDE.md blocks, the §13 snippet).
@@ -439,16 +467,42 @@ const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', '
 // poll paths hand redPrLines the same thing. `failingTestsFor(sha)` reads the unit-report
 // status (gh pr view omits a status's description) and is asked only once that status is
 // itself red, i.e. posted. Null when nothing is red. Pure + exported.
-function localMergeDriver(pr, failingTestsFor = () => null) {
+// task 1004289 — `neverStarted(rawCheck)` answers "did this red job never run at all?"
+// (jobNeverStarted below). When EVERY red check is one, nothing was tested, and the
+// answer is { reason: 'ci_not_started:<name>', not_started: true, run_id } rather than
+// a failing check the builder is told to fix.
+function localMergeDriver(pr, failingTestsFor = () => null, neverStarted = () => false) {
   if (!pr || pr.state !== 'OPEN' || !Array.isArray(pr.statusCheckRollup)) return null;
   const { checks } = readCheckRollup({ contexts: { nodes: pr.statusCheckRollup } });
   const red = checks.filter((c) => RED_CONCLUSIONS.has(String(c.conclusion || '').toUpperCase()));
   if (!red.length) return null;
+  const redRaw = pr.statusCheckRollup.filter((c) => c && RED_CONCLUSIONS.has(String(c.conclusion || c.state || '').toUpperCase()));
+  if (redRaw.length && redRaw.every((c) => neverStarted(c))) {
+    const run = /\/runs\/(\d+)\//.exec(String(redRaw[0].detailsUrl || ''));
+    return { reason: `ci_not_started:${red[0].name}`, not_started: true, failing_tests: null, run_id: run ? run[1] : null };
+  }
   const kind = pr.mergeStateStatus === 'UNSTABLE' ? 'non_required_check_failing' : 'failing_check';
   const reported = red.some((c) => c.name === UNIT_REPORT_CONTEXT);
   return { reason: `${kind}:${red[0].name}`, failing_tests: (reported && failingTestsFor(pr.headRefOid)) || null };
 }
 
+// jobNeverStarted — task 1004289. When the account cannot run Actions (its budget is
+// spent, or a payment failed), GitHub still marks every job FAILED seconds after it was
+// queued, with no steps and no runner, and one annotation saying why: "The job was not
+// started because an Actions budget is preventing further use." (PR 1211, 2026-09-25).
+// Read as an ordinary red check, that told the builder to fix their code — advice that
+// cannot help, where each retry is another failed run. An Actions job's id (the tail of
+// its detailsUrl) is its check-run id, so its annotations are one read away. FAIL-OPEN:
+// anything unreadable is "no", which keeps the ordinary red wording. `gh` is injectable.
+const NOT_STARTED_RE = /^\s*The job was not started because\b/i;
+function jobNeverStarted(check, gh = ghJson) {
+  if (!check || (check.__typename && check.__typename !== 'CheckRun')) return false;
+  const m = /\/job\/(\d+)(?:[/?#]|$)/.exec(String(check.detailsUrl || ''));
+  if (!m) return false;
+  const notes = gh(['api', `repos/{owner}/{repo}/check-runs/${m[1]}/annotations`]);
+  return Array.isArray(notes) && notes.some((a) => a && NOT_STARTED_RE.test(String(a.message || '')));
+}
+
 // unitReportFor — the failing-test line the `unit` workflow posted on `sha`, read with this
 // machine's gh through the same parser the server uses. Null when unreadable; the red line
 // then names the check instead, as it did before the report existed. `gh` is injectable.
@@ -921,6 +975,14 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
     if (sha !== report.sha) report = { sha, text: unitReportFor(sha, readJson) };
     return report.text;
   };
+  // task 1004289: a finished job's annotations never change, so each is read once.
+  let notStarted = false;
+  const startMemo = new Map();
+  const neverStarted = (c) => {
+    const key = String((c && c.detailsUrl) || '');
+    if (!startMemo.has(key)) startMemo.set(key, jobNeverStarted(c, readJson));
+    return startMemo.get(key);
+  };
   for (let i = 0; i < MERGE_TRIES; i++) {
     // task 1003499: mergeable + mergeStateStatus ride the same read, so a conflict is
     // named on the poll it appears; the two-field read is the fallback for a gh that
@@ -937,13 +999,14 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
       return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
     }
     if (pr) {
-      const md = localMergeDriver(pr, failingTestsFor);
+      const md = localMergeDriver(pr, failingTestsFor, neverStarted);
       const red = redPrLine(md);
       if (red && red !== redLine) {
         redLine = red;
         for (const line of redPrLines(md, { taskId, via: 'local' })) console.log(line);
       }
       stuckRed = !!red && redBlocksMerge(md);
+      notStarted = !!(md && md.not_started);
     }
     conflicting = noteConflict(taskId, pr, conflicting);
     pause();
@@ -954,7 +1017,7 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
     // CONFLICTING (task 1003499): then nothing is still in CI, and it never merges.
     // Or RED (task 1003764): then the banner says the land is stuck on that check.
     if (conflicting) return landConflicted(taskId);
-    printLandPending(taskId, { red: stuckRed });
+    printLandPending(taskId, { red: stuckRed, notStarted });
     return landPending();
   }
   console.log(`  ci-land: merged to main (${mergeSha.slice(0, 8)}). Waiting for the prod deploy...`);
@@ -1036,6 +1099,9 @@ module.exports = {
   redBlocksMerge,
   localMergeDriver,
   unitReportFor,
+  // task 1004289: CI that never ran is said as such, not as a failure to fix.
+  jobNeverStarted,
+  notStartedLines,
   reconciledCardStatus,
   strandCommand,
   strandNextStep,

package/src/bongos/module-scope-map.js

@@ -335,6 +335,11 @@ const MODULE_GLOBS = {
   //     The instance-side CLIENT half of federation is woven into core auth.js and is
   //     kernel territory (ADR 0141 §Packaging), NOT this key.
   'platform-identity': ['modules/platform-identity/'],
+  // --- the npm-release module (task 1002622): the deploy page's "where the work is" +
+  //     version history, and later its Release step. Its tests live at the repo root
+  //     (tests/npm_release_*.mjs) because a default-off module's own tests/ is skipped
+  //     by the unit runner. The /deploy page shell stays hall-ui's (one key per surface).
+  'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
   //     lifecycle/dev-box precedent). Covers the projects-surface work (goal

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1038'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1040'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/conflict_resolve.mjs

@@ -16,6 +16,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const cr = require('../modules/lifecycle/conflict-resolve.js');
@@ -90,6 +91,7 @@ function mkExec(scn = {}) {
 
 function mkDeps(scn = {}, over = {}) {
   const reg = [];
+  const regOpts = [];
   const exec = mkExec(scn);
   const genCalls = [];
   return {
@@ -105,12 +107,13 @@ function mkDeps(scn = {}, over = {}) {
       buildAuthUrl: () => 'https://x-access-token:REDACTED@github.com/o/r.git',
     },
     repoInfo: over.repoInfo === undefined ? { owner: 'o', repo: 'r' } : over.repoInfo,
-    registerMergeDriver: (root) => { reg.push(root); },
+    registerMergeDriver: (root, opts) => { reg.push(root); regOpts.push(opts); },
     repoRoot: '/srv/repo',
     mkdtemp: () => '/tmp/otb-resolve-test',
     rmtmp: () => {},
     _exec: exec,
     _reg: reg,
+    _regOpts: regOpts,
     _gen: genCalls,
   };
 }
@@ -129,6 +132,17 @@ test('clean generated/index merge → resolved + pushed; driver registered in th
   assert.ok(ran(deps._exec, 'push'), 'the resolved branch is pushed');
 });
 
+// Task 1003368 (audit B2): the driver command must name the SERVER's copy of the script,
+// never the clone's (which is the builder's branch).
+test('the otb-regen driver is pinned to the server checkout, not the clone', async () => {
+  const deps = mkDeps({ merge: 'clean', before: 'oldsha1', after: 'newsha2' });
+  await cr.resolveBranchConflicts({ branch: 'claude/wt-1' }, deps);
+  const script = deps._regOpts[0] && deps._regOpts[0].driverScript;
+  assert.ok(script, 'registration must pass a driverScript');
+  assert.equal(path.resolve(script), path.resolve('/srv/repo', 'scripts', 'gds', 'git-merge-regen.js'));
+  assert.ok(!path.resolve(script).startsWith(path.resolve('/tmp/otb-resolve-test')), 'never inside the clone');
+});
+
 test('genuine hand-written conflict → NOT resolved, merge aborted, never pushed', async () => {
   const deps = mkDeps({ merge: 'conflict', conflicted: ['src/bongos/db.js'] });
   const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-2' }, deps);

package/tests/merge_driver_register.mjs

@@ -99,6 +99,34 @@ test('registerMergeDriver writes .driver BEFORE .name', () => {
     'order is the fix: the intermediate state after write #1 must be the SAFE one');
 });
 
+// Task 1003368 (audit B2): the default command is RELATIVE, which git resolves against the
+// checked-out tree. The server passes an absolute driverScript so the command never names a
+// file the branch could have written.
+test('registerMergeDriver: default command stays relative, driverScript pins an absolute path', () => {
+  const commands = [];
+  const run = (_bin, args) => { if (args[1] === `merge.${MERGE_DRIVER_NAME}.driver`) commands.push(args[2]); };
+  registerMergeDriver('/nowhere', { run });
+  assert.equal(commands[0], 'node scripts/gds/git-merge-regen.js %O %A %B %P');
+
+  const script = path.join(REPO_ROOT, 'scripts', 'gds', 'git-merge-regen.js');
+  registerMergeDriver('/nowhere', { run, driverScript: script });
+  const pinned = commands[1];
+  const m = pinned.match(/^node "([^"]+)" %O %A %B %P$/);
+  assert.ok(m, `pinned command has the quoted-absolute shape, got: ${pinned}`);
+  assert.ok(path.isAbsolute(m[1]), 'the pinned path must be absolute');
+  assert.ok(!m[1].includes('\\'), 'backslashes would be eaten by sh -c');
+  assert.equal(path.resolve(m[1]), script);
+});
+
+test('registerMergeDriver: a path that could break out of the quotes is refused, leaving no trace', () => {
+  const calls = [];
+  const run = (_bin, args) => { calls.push(args); };
+  const res = registerMergeDriver('/nowhere', { run, driverScript: '/srv/x"; touch pwned; "/a.js' });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /unsafe merge driver path/);
+  assert.ok(!calls.some((a) => a[1] === `merge.${MERGE_DRIVER_NAME}.driver`), 'nothing may be written');
+});
+
 test('a failure mid-registration removes the whole section, leaving no trace', () => {
   const calls = [];
   const run = (_bin, args) => {

package/tests/module_loader.mjs

@@ -276,7 +276,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/npm_release_page.mjs

@@ -0,0 +1,173 @@
+// tests/npm_release_page.mjs — the npm-release module's deploy-page sections, EXECUTED
+// (task 1002622): modules/npm-release/public/work.js run in a DOM stub against a real
+// reading, and deploy.js's loader that decides whether that script is fetched at all.
+//
+// WHAT IS AT RISK. The page's whole reason to exist is naming the work, so the cases pin
+// that the work is named (every task, by title, linked), that a partial reading SAYS it is
+// partial, that a reader the route refuses sees nothing rather than an error, and that a
+// hall without the module never asks for its script.
+//
+// Run:  node tests/npm_release_page.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const WORK_SRC = fs.readFileSync(path.join(ROOT, 'modules/npm-release/public/work.js'), 'utf8');
+const DEPLOY_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
+// The fixture the hall-preview harness serves — a reading taken off the live registry.
+const FIXTURE = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/npm-release__work.json'), 'utf8'));
+
+const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+function makeEl() {
+  return { hidden: true, _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+}
+
+/** Run work.js with `answer(query)` standing in for the route. */
+function bootWork(answer) {
+  const els = new Map([['nr-work', makeEl()], ['nr-versions', makeEl()]]);
+  const asked = [];
+  const clicks = [];
+  const head = [];
+  const documentObj = {
+    getElementById: (id) => els.get(id) || null,
+    addEventListener(ev, fn) { if (ev === 'click') clicks.push(fn); },
+    createElement: () => ({}),
+    head: { appendChild: (n) => head.push(n) },
+  };
+  const request = async (method, url) => {
+    const q = url.includes('?') ? url.slice(url.indexOf('?') + 1) : '';
+    asked.push(q);
+    return answer(q);
+  };
+  const windowObj = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: { escapeHtml, toast() {} },
+  };
+  class Element {}
+  const sandbox = { window: windowObj, document: documentObj, Element, console, setTimeout, Date, Set, Map, Promise, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(WORK_SRC, sandbox, { filename: 'work.js' });
+  const settle = async () => { for (let i = 0; i < 20; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { els, asked, head, settle, work: () => els.get('nr-work'), versions: () => els.get('nr-versions') };
+}
+
+const ok = (data) => ({ ok: true, status: 200, data });
+
+test('every recent task is named, by title, linked to its page', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.equal(b.work().hidden, false);
+  for (const [stage, rows] of Object.entries(FIXTURE.stages)) {
+    // Stages longer than the fold show their first rows; the rest sit behind "Show all".
+    for (const t of rows.slice(0, 8)) {
+      assert.ok(html.includes(`href="/task/${t.id}"`), `${stage}: task ${t.id} is linked`);
+      assert.ok(html.includes(escapeHtml(t.title)), `${stage}: task ${t.id} is named`);
+    }
+  }
+  assert.match(html, /Show all 15/);
+});
+
+test('the counts strip carries every stage, and the stage sentence sits under its head', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  const html = b.work().innerHTML;
+  for (const fig of ['Not merged', 'Unversioned', 'Not running', 'Unreleased', 'Released', 'No version']) {
+    assert.ok(html.includes(`>${fig}</span>`), fig);
+  }
+  assert.doesNotMatch(html, /ov-group__note/, 'a sentence in the note slot squeezes the head on a phone');
+  assert.match(html, /Already offered to other projects\./, 'said once for the group when true of every row');
+});
+
+test('the version history lists each version with its tasks, and asks for a short first page', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  assert.equal(b.asked[0], 'limit=6');
+  const html = b.versions().innerHTML;
+  for (const v of FIXTURE.history.versions) assert.ok(html.includes(`data-version="${v.version}"`), v.version);
+  assert.match(html, /running here|released/);
+  assert.match(html, /Show older versions/);
+  assert.equal(b.head.length, 1, 'the module stylesheet is loaded once');
+});
+
+test('a partial reading says it is partial', async () => {
+  const partial = { ...FIXTURE, registry: { ok: false, error: 'the registry answered 503' }, notes: { ...FIXTURE.notes, error: 'could not download 1.19.1039' } };
+  const b = bootWork(() => ok(partial));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, /Partial reading/);
+  assert.match(html, /registry could not be read \(the registry answered 503\)/);
+  assert.match(html, /could not download 1\.19\.1039/);
+});
+
+test('a version whose notes could not be read is never shown as a version with no work', async () => {
+  const d = JSON.parse(JSON.stringify(FIXTURE));
+  d.history.versions[0].entries = null;
+  d.history.versions[1].entries = [];
+  const b = bootWork(() => ok(d));
+  await b.settle();
+  const html = b.versions().innerHTML;
+  assert.match(html, /notes could not be read/);
+  assert.match(html, /housekeeping merges only/);
+});
+
+test('a reader the route refuses sees nothing, not an error', async () => {
+  for (const status of [401, 403, 404]) {
+    const b = bootWork(() => ({ ok: false, status, data: {} }));
+    await b.settle();
+    assert.equal(b.work().hidden, true, `${status} keeps the section hidden`);
+  }
+});
+
+test('a server failure is said in words', async () => {
+  const b = bootWork(() => ({ ok: false, status: 500, data: { error: { message: 'Could not read where the work is right now.' } } }));
+  await b.settle();
+  assert.equal(b.work().hidden, false);
+  assert.match(b.work().innerHTML, /Could not read where the work is right now\./);
+});
+
+test('task titles are escaped', async () => {
+  const d = JSON.parse(JSON.stringify(FIXTURE));
+  d.stages.not_merged[0].title = '<img src=x onerror=alert(1)>';
+  const b = bootWork(() => ok(d));
+  await b.settle();
+  assert.doesNotMatch(b.work().innerHTML, /<img src=x/);
+});
+
+// ---- deploy.js's loader ---------------------------------------------------------
+
+function bootDeploy({ modules, search = '' }) {
+  const appended = [];
+  const documentObj = {
+    getElementById: () => ({ hidden: false, textContent: '', innerHTML: '', addEventListener() {} }),
+    addEventListener(ev, fn) { if (ev === 'DOMContentLoaded') this._ready = fn; },
+    createElement: () => ({}),
+    body: { appendChild: (n) => appended.push(n) },
+  };
+  const request = async () => ({ ok: false, status: 403, data: {} });
+  const windowObj = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: { escapeHtml, toast() {} },
+    location: { assign() {}, search },
+    __MODULES__: modules,
+    __deployPollMs: 0,
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, Date, Set, Map, Promise, decodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(DEPLOY_SRC, sandbox, { filename: 'deploy.js' });
+  documentObj._ready();
+  return appended;
+}
+
+test('the deploy page loads the module script only for its own view, and only with the module on', () => {
+  const on = { enabled: { 'npm-release': true } };
+  assert.deepEqual(bootDeploy({ modules: on }).map((s) => s.src), ['/modules/npm-release/public/work.js']);
+  assert.deepEqual(bootDeploy({ modules: { enabled: { 'npm-release': false } } }), [], 'module off: no request for a script that would 404');
+  assert.deepEqual(bootDeploy({ modules: undefined }), [], 'no module record at all');
+  assert.deepEqual(bootDeploy({ modules: on, search: '?project=mercury' }), [], 'another project\'s view is not this package\'s');
+});