@bongos/core 1.19.1041 → 1.19.1043

package/tests/main_audit_attestation.mjs

@@ -0,0 +1,238 @@
+// tests/main_audit_attestation.mjs — the main audit's attestation pass (task 1001433).
+//
+// The pass ties every permission-sensitive commit on main to the pull request that
+// brought it in, and requires that PR's head to carry the server's `gate-author-trust`
+// status, posted by the server's own GitHub identity. The author NAME the older pass
+// reads is typed text; the status creator is not. FLAG-ONLY by the owner's ruling
+// (2026-09-26): findings are 'review', never 'blocker'.
+//
+// Everything here runs on injected git + fetch seams — no repository, no network.
+//
+// Run:  node --test tests/main_audit_attestation.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const audit = require('../scripts/gds/main-audit.js');
+const {
+  ATTEST_CONTEXT, mapIntroducingHeads, isAttested, analyzeAttestation, attestationConfig,
+  fetchAttestations, runAttestationPass,
+} = audit;
+
+const sha = (c) => c.repeat(40);
+const PROTECTED = 'src/bongos/auth.js';  // floored in the real registry
+const PLAIN = 'docs/notes.md';           // not a protected surface
+const status = (login, state = 'success', context = ATTEST_CONTEXT) => ({ context, state, creator: { login } });
+
+// A tiny history. Mainline: R (release) ← M (merges PR head H over base B).
+// The PR carried two commits: A (protected) then H (the head, plain).
+const B = sha('b'); const A = sha('a'); const H = sha('h'); const M = sha('m'); const D = sha('d');
+const commitA = { sha: A, authorName: 'somemetic', parents: [B], files: [PROTECTED] };
+const commitH = { sha: H, authorName: 'somemetic', parents: [A], files: [PLAIN] };
+const mergeM = { sha: M, authorName: 'Lars', parents: [B, H], isMerge: true, files: [] };
+// D: a protected commit pushed straight onto main (no merge brought it in).
+const directD = { sha: D, authorName: 'IAMMASTERQUA', parents: [M], files: [PROTECTED] };
+const revRanges = { [`${B}..${H}`]: [H, A] };
+const revList = (r) => revRanges[r] || [];
+
+test('the real registry still floors the fixture paths the way these tests assume', () => {
+  const ppc = require('../src/bongos/permission-path-check.js');
+  assert.ok(ppc.matchProtected([PROTECTED]).length > 0, `${PROTECTED} must be protected`);
+  assert.equal(ppc.matchProtected([PLAIN]).length, 0, `${PLAIN} must not be protected`);
+});
+
+// ---- mapIntroducingHeads ----
+
+test('a mainline merge vouches for every commit its PR brought in, via its SECOND parent', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  assert.equal(headOf.get(A), H);
+  assert.equal(headOf.get(H), H, 'a PR head vouches for itself');
+  assert.equal(headOf.has(D), false, 'a direct push has no introducing merge');
+});
+
+test('a commit keeps the FIRST merge that claims it; single-parent commits are ignored', () => {
+  const other = { sha: sha('n'), parents: [sha('x'), sha('y')] };
+  const headOf = mapIntroducingHeads([mergeM, other, commitA], (r) => (r === `${sha('x')}..${sha('y')}` ? [A] : revList(r)));
+  assert.equal(headOf.get(A), H);
+});
+
+// ---- isAttested: the creator is the part that cannot be faked ----
+
+test('a success from the trusted account attests; the login match ignores case', () => {
+  assert.equal(isAttested([status('owner-acct')], 'Owner-Acct'), true);
+});
+
+test('FORGERY: the same context posted by any other account attests nothing', () => {
+  assert.equal(isAttested([status('IAMMASTERQUA')], 'owner-acct'), false);
+  assert.equal(isAttested([status('github-actions[bot]')], 'owner-acct'), false);
+});
+
+test("only the trusted account's NEWEST status for the context decides", () => {
+  // newest first, as GitHub returns them
+  assert.equal(isAttested([status('owner-acct', 'failure'), status('owner-acct', 'success')], 'owner-acct'), false, 'a later failure withdraws');
+  assert.equal(isAttested([status('owner-acct', 'success'), status('owner-acct', 'failure')], 'owner-acct'), true, 'a later success restores');
+  // another account can neither attest nor revoke
+  assert.equal(isAttested([status('mallory', 'failure'), status('owner-acct', 'success')], 'owner-acct'), true);
+});
+
+test('another context, a pending state, or no trusted login attests nothing', () => {
+  assert.equal(isAttested([status('owner-acct', 'success', 'unit-report')], 'owner-acct'), false);
+  assert.equal(isAttested([status('owner-acct', 'pending')], 'owner-acct'), false);
+  assert.equal(isAttested([status('owner-acct')], ''), false);
+  assert.equal(isAttested(null, 'owner-acct'), false);
+});
+
+// ---- analyzeAttestation ----
+
+test('an attested PR head clears every protected commit it brought in', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  const r = analyzeAttestation([commitA, commitH], { headOf, attested: new Set([H]), trustedLogin: 'owner-acct' });
+  assert.equal(r.checked, 1, 'only the protected commit is checked');
+  assert.deepEqual(r.findings, []);
+});
+
+test('an unattested PR head is a REVIEW finding naming the head — never a blocker', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  const r = analyzeAttestation([commitA], { headOf, attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.equal(r.findings.length, 1);
+  const f = r.findings[0];
+  assert.equal(f.severity, 'review', 'flag-only: the owner ruled this pass must not gate');
+  assert.equal(f.kind, 'unattested');
+  assert.equal(f.head, H);
+  assert.match(f.summary, /pull request that brought it in \(head hhhhhhhhh\)/);
+  assert.match(f.summary, /gate-author-trust' status from 'owner-acct'/);
+});
+
+test('a direct push to main is flagged as having no pull request at all', () => {
+  const r = analyzeAttestation([directD], { headOf: new Map(), attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].severity, 'review');
+  assert.equal(r.findings[0].head, D);
+  assert.match(r.findings[0].summary, /without passing through a pull request/);
+});
+
+test('a ONE-commit pull request (head === the commit) still reads as a pull request', () => {
+  const lone = { sha: H, authorName: 'somemetic', parents: [B], files: [PROTECTED] };
+  const r = analyzeAttestation([lone], { headOf: new Map([[H, H]]), attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.match(r.findings[0].summary, /pull request that brought it in/);
+  assert.doesNotMatch(r.findings[0].summary, /without passing through a pull request/);
+});
+
+test('a direct push that carries the attestation ITSELF is cleared', () => {
+  const r = analyzeAttestation([directD], { headOf: new Map(), attested: new Set([D]), trustedLogin: 'owner-acct' });
+  assert.deepEqual(r.findings, []);
+});
+
+// ---- attestationConfig ----
+
+test('config: Actions env first, GH_TOKEN as the laptop fallback, owner as the default login', () => {
+  assert.deepEqual(attestationConfig({ env: { GITHUB_TOKEN: 't1', GITHUB_REPOSITORY: 'owner-acct/core' } }),
+    { token: 't1', repo: 'owner-acct/core', trustedLogin: 'owner-acct' });
+  assert.equal(attestationConfig({ env: { GH_TOKEN: 't2' } }).token, 't2');
+  assert.equal(attestationConfig({ env: {} }).token, null);
+});
+
+test('config: the repo is read from the origin remote without ever capturing a credential in it', () => {
+  const https = attestationConfig({ env: {}, remoteUrl: 'https://x-access-token:SECRET@github.com/owner/repo.git' });
+  assert.equal(https.repo, 'owner/repo');
+  assert.ok(!JSON.stringify(https).includes('SECRET'));
+  assert.equal(attestationConfig({ env: {}, remoteUrl: 'git@github.com:owner/repo.git' }).repo, 'owner/repo');
+  assert.equal(attestationConfig({ env: {}, remoteUrl: 'https://example.com/x/y.git' }).repo, null);
+});
+
+test('config: --attest-login overrides the owner default (an App-posting instance)', () => {
+  const c = attestationConfig({ env: { GITHUB_REPOSITORY: 'o/r' }, loginArg: 'bongos-app[bot]' });
+  assert.equal(c.trustedLogin, 'bongos-app[bot]');
+});
+
+// ---- fetchAttestations ----
+
+function stubFetch(bySha) {
+  const calls = [];
+  const impl = async (url, init) => {
+    calls.push({ url, init });
+    const s = Object.keys(bySha).find((k) => url.includes(`/commits/${k}/`));
+    const r = bySha[s];
+    if (r instanceof Error) throw r;
+    if (typeof r === 'number') return { ok: false, status: r, json: async () => ({}) };
+    return { ok: true, status: 200, json: async () => r };
+  };
+  return { impl, calls };
+}
+
+test('fetch: reads each head once, keeps only the trusted attestations, sends the token', async () => {
+  const { impl, calls } = stubFetch({ [H]: [status('owner-acct')], [D]: [status('mallory')] });
+  const r = await fetchAttestations([H, D, H], { repo: 'o/r', token: 'tok', trustedLogin: 'owner-acct', fetchImpl: impl });
+  assert.deepEqual([...r.attested], [H]);
+  assert.deepEqual(r.unreadable, []);
+  assert.equal(calls.length, 2, 'a head shared by several commits is read once');
+  assert.equal(calls[0].url, `https://api.github.com/repos/o/r/commits/${H}/statuses?per_page=100`);
+  assert.equal(calls[0].init.headers.Authorization, 'Bearer tok');
+});
+
+test('fetch: an unreadable head is reported, never counted as attested or unattested', async () => {
+  const { impl } = stubFetch({ [H]: 404, [D]: new Error('network down') });
+  const r = await fetchAttestations([H, D], { repo: 'o/r', token: 'tok', trustedLogin: 'owner-acct', fetchImpl: impl });
+  assert.equal(r.attested.size, 0);
+  assert.deepEqual(r.unreadable.map((u) => u.reason), ['HTTP 404', 'network down']);
+});
+
+// ---- runAttestationPass: the whole pass on fake git + fetch ----
+
+function fakeGit({ mainline, ranges, remote = 'https://github.com/o/r.git' }) {
+  return (args) => {
+    if (args === 'remote get-url origin') return `${remote}\n`;
+    if (args.startsWith('rev-list --first-parent ')) return mainline.join('\n');
+    if (args.startsWith('rev-list ')) return (ranges[args.slice('rev-list '.length)] || []).join('\n');
+    throw new Error(`unexpected git ${args}`);
+  };
+}
+const history = [directD, mergeM, commitH, commitA];
+const gitImpl = fakeGit({ mainline: [D, M], ranges: revRanges });
+
+test('pass: nothing protected in range → it ran, checked nothing, needed no token', async () => {
+  const r = await runAttestationPass([commitH], 'x..y', { env: {}, gitImpl: () => { throw new Error('git must not be called'); } });
+  assert.deepEqual(r, { ran: true, checked: 0, findings: [] });
+});
+
+test('pass: no token → DID NOT RUN with the reason, never a clean pass', async () => {
+  const r = await runAttestationPass(history, 'x..y', { env: {}, gitImpl });
+  assert.equal(r.ran, false);
+  assert.match(r.reason, /no GitHub token/);
+});
+
+test('pass: end to end — the attested PR clears, the direct push is flagged', async () => {
+  const { impl } = stubFetch({ [H]: [status('o')], [D]: [] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.equal(r.ran, true);
+  assert.equal(r.checked, 2);
+  assert.deepEqual(r.findings.map((f) => f.sha), [D]);
+  assert.equal(r.trustedLogin, 'o', 'the owner of the origin remote');
+});
+
+test('pass: a FORGED mark on the PR head (right name, wrong account) is flagged', async () => {
+  const { impl } = stubFetch({ [H]: [status('IAMMASTERQUA')], [D]: [status('o')] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.deepEqual(r.findings.map((f) => f.sha), [A]);
+  assert.ok(r.findings.every((f) => f.severity === 'review'));
+});
+
+test('pass: a head it could not read makes the whole pass DID NOT RUN', async () => {
+  const { impl } = stubFetch({ [H]: 502, [D]: [status('o')] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.equal(r.ran, false);
+  assert.match(r.reason, /could not read the commit statuses of 1 pull-request head/);
+});
+
+test('pass: a merge INSIDE a pull request never vouches — only mainline merges do', async () => {
+  // I: a branch's "merge main into me" whose second parent is a main commit P.
+  const P = sha('p'); const I = sha('i');
+  const inner = { sha: I, authorName: 'x', parents: [A, P], isMerge: true, files: [] };
+  const mainP = { sha: P, authorName: 'x', parents: [B], files: [PROTECTED] };
+  const g = fakeGit({ mainline: [P], ranges: { [`${A}..${P}`]: [P] } });
+  const { impl } = stubFetch({ [P]: [] });
+  const r = await runAttestationPass([inner, mainP], 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl: g, fetchImpl: impl });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].head, P, 'P answers for itself; the inner merge did not claim it');
+});

package/tests/module_api.mjs

@@ -56,6 +56,7 @@ const PUBLISHED_SURFACE = [
   'buildInfo', 'validateOrRespond', 'LIMITS', 'parseId', 'asyncHandler', 'corsPublicGet', // parseId added 1.8.0 (BV1.R78); asyncHandler + corsPublicGet added 1.12.0 (BV1.R86; lifecycle routes)
   'parsePagination', 'pageMeta', 'PAGINATION', // R14 (#2001, 1.17.0): shared pagination contract for module list routes (ADR 0119)
   'responsibilityFor', 'ROLE_RESPONSIBILITIES', // added by task 1003732 (ADR 0275; criterion wa6-written-responsibilities): the ONE source for the sentence each craft is answerable for. It rides the doorway because two modules need the same text — grading judges role-shaped work against it, the hall shows it to the person being judged — and modules never import each other. Declared here deliberately: this list is what makes adding to the doorway a decision rather than a side effect
+  'readPackageRegistry', // added by task 1004296 (ADR 0340 D5): the npm registry reader moved into the core, because Settings → Software update needs it in every hall; the module that publishes a package reads the same answer and cache through here rather than keeping a second copy
   'logger',
 ];
 

package/tests/module_loader.mjs

@@ -330,6 +330,33 @@ test('hallWidgetScripts: a module with no uiSections is never listed', () => {
   loader._reset();
 });
 
+// task 1004301 — the same seam, one file per page: task-widget.js for a task's own page.
+test('hallWidgetScripts: file task-widget.js lists the modules that ship one, and only those', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['a'] } }), files: { 'public/task-widget.js': '// task line' } },
+    beta: { manifest: validManifest('beta', { contributes: { uiSections: ['b'] } }), files: { 'public/hall-widget.js': '// index only' } },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true, file: 'task-widget.js' }, opts),
+    [{ key: 'alpha', src: '/modules/alpha/public/task-widget.js' }]);
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true }, opts),
+    [{ key: 'beta', src: '/modules/beta/public/hall-widget.js' }], 'the default is still the index widget');
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: (k) => k !== 'alpha', file: 'task-widget.js' }, opts), [], 'disabled: never listed');
+  loader._reset();
+});
+
+test('hallWidgetScripts: a file name outside the page allowlist lists nothing — it is not a file server', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['a'] } }), files: { 'public/secrets.js': '//', 'public/task-widget.js': '//' } },
+  });
+  for (const file of ['secrets.js', '../module.json', 'public/task-widget.js', 'TASK-WIDGET.JS']) {
+    assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true, file }, { roots: [root], core: '1.0.0' }), [], file);
+  }
+  loader._reset();
+});
+
 // --- moduleWebSurfaces: an enabled module's host-routed static surface resolves,
 //     a disabled one vanishes (BV1.R84 / task 1635, ADR 0093 §1 / 02-module-map §6) ---
 

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '983282a83fd5aa71';
+const SHELL_SHA = 'ff2017aa9bbbc507';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/npm_release_page.mjs

@@ -22,6 +22,8 @@ const DEPLOY_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deplo
 const FIXTURE = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/npm-release__work.json'), 'utf8'));
 
 const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+// Voice rule V4: quoted data renders with its dashes as commas (docs/voice.md).
+const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
 
 function makeEl() {
   return { hidden: true, _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
@@ -67,7 +69,7 @@ test('every recent task is named, by title, linked to its page', async () => {
     // Stages longer than the fold show their first rows; the rest sit behind "Show all".
     for (const t of rows.slice(0, 8)) {
       assert.ok(html.includes(`href="/task/${t.id}"`), `${stage}: task ${t.id} is linked`);
-      assert.ok(html.includes(escapeHtml(t.title)), `${stage}: task ${t.id} is named`);
+      assert.ok(html.includes(escapeHtml(unDash(t.title))), `${stage}: task ${t.id} is named`);
     }
   }
   assert.match(html, /Show all 15/);
@@ -171,3 +173,11 @@ test('the deploy page loads the module script only for its own view, and only wi
   assert.deepEqual(bootDeploy({ modules: undefined }), [], 'no module record at all');
   assert.deepEqual(bootDeploy({ modules: on, search: '?project=mercury' }), [], 'another project\'s view is not this package\'s');
 });
+
+test('a task title and a note line are quoted ledger data: their dashes render as commas (V4)', async () => {
+  const stages = { ...FIXTURE.stages, not_merged: [{ ...FIXTURE.stages.not_merged[0], title: 'Deploy page — where the work is – phase 1' }] };
+  const b = bootWork(() => ok({ ...FIXTURE, stages }));
+  await b.settle();
+  assert.ok(b.work().innerHTML.includes('>Deploy page, where the work is, phase 1</a>'));
+  assert.doesNotMatch(b.work().innerHTML, /Deploy page [—–]/);
+});

package/tests/npm_release_where.mjs

@@ -0,0 +1,323 @@
+// tests/npm_release_where.mjs — a task's own page says where its code is (task 1004301):
+// the npm-release module's one-task reading (readTaskWhere), its route, the browser widget
+// that draws the line, and the core seam that puts the widget on the task page without the
+// page naming the module.
+//
+// WHAT IS AT RISK. The line is read by the person who shipped the task, and the case the
+// task exists for is the ship that never landed: "done, but not merged" must be said for a
+// completed/confirmed task, never a version it is not in. Every other stage must be the
+// deploy page's own answer, the widget must write only into the slot the page gives it and
+// only for the task still on screen, and a failure must draw nothing rather than something
+// wrong.
+//
+// Run:  node tests/npm_release_where.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { npmTarball, npmPackument, fakeHttpsGet } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { readTaskWhere } = require('../modules/npm-release/work.js');
+const buildRouter = require('../modules/npm-release/routes/task-where.js');
+
+const ORIGIN = 'https://registry.npmjs.org';
+const PKG = '@bongos/core';
+const TIMES = {
+  '1.0.1': '2026-09-22T10:00:00.000Z',
+  '1.0.2': '2026-09-23T10:00:00.000Z',
+  '1.0.3': '2026-09-24T10:00:00.000Z',
+  '1.0.4': '2026-09-25T10:00:00.000Z',
+};
+const NOTES = {
+  '1.0.1': [{ id: '11', text: 'Released long ago.' }],
+  '1.0.2': [{ id: '12', text: 'Running here, not released.' }],
+  '1.0.3': [{ id: '13', text: 'Published, not running.' }, { text: 'A hand-landed change nobody numbered.' }],
+  '1.0.4': [],
+};
+const TASKS = {
+  11: { status: 'shipped', value_summary: 'x', at: '2026-09-21T12:00:00Z' },
+  12: { status: 'shipped', value_summary: 'x', at: '2026-09-22T12:00:00Z' },
+  13: { status: 'shipped', value_summary: 'x', at: '2026-09-23T12:00:00Z' },
+  14: { status: 'shipped', value_summary: 'A hand-landed change nobody numbered.', at: '2026-09-23T13:00:00Z' },
+  15: { status: 'shipped', value_summary: 'Merged after the last version.', at: '2026-09-25T12:00:00Z' },
+  16: { status: 'shipped', value_summary: 'A scope edit.', at: '2026-09-20T12:00:00Z' },
+  20: { status: 'confirmed', value_summary: 'Stranded.', at: '2026-09-25T12:00:00Z' },
+  21: { status: 'completed', value_summary: null, at: '2026-09-25T13:00:00Z' },
+  30: { status: 'active', value_summary: null, at: '2026-09-25T13:00:00Z' },
+};
+
+function fakePool() {
+  const queries = [];
+  return {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql, params });
+      if (/FROM tasks WHERE id = \$1::bigint/.test(sql)) {
+        const t = TASKS[params[0]];
+        return { rows: t ? [{ id: params[0], ...t }] : [] };
+      }
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+const freshStore = () => ({ packument: { at: 0, value: null, inflight: null }, notes: { version: null, at: 0, value: null, inflight: null } });
+
+function setup({ latest = '1.0.1', pkStatus = 200 } = {}) {
+  const versions = Object.keys(TIMES);
+  const newest = versions[versions.length - 1];
+  const fg = fakeHttpsGet({
+    [`${ORIGIN}/@bongos%2fcore`]: { status: pkStatus, body: pkStatus === 200 ? npmPackument({ versions, latest, times: TIMES }) : 'nope' },
+    [`${ORIGIN}/@bongos/core/-/core-${newest}.tgz`]: { body: npmTarball({ notes: NOTES }) },
+  });
+  const pool = fakePool();
+  const store = freshStore();
+  const read = (id, over = {}) => readTaskWhere({ pool, id, pkg: PKG, live: '1.0.2', get: fg.get, store, installedNotes: () => null, now: () => Date.parse('2026-09-26T13:00:00Z'), ...over });
+  return { read, pool, asked: fg.asked };
+}
+
+// ---- the reading ---------------------------------------------------------------------
+
+test('each shipped task gets the deploy page\'s own stage and the version that carries it', async () => {
+  const { read } = setup();
+  const pick = async (id) => { const w = await read(id); return [w.stage, w.version]; };
+  assert.deepEqual(await pick(11), ['released', '1.0.1']);
+  assert.deepEqual(await pick(12), ['live_unreleased', '1.0.2']);
+  assert.deepEqual(await pick(13), ['not_live', '1.0.3']);
+  assert.deepEqual(await pick(14), ['not_live', '1.0.3'], 'a hand-landed merge is matched on the ship summary');
+  assert.deepEqual(await pick(15), ['unversioned', null], 'merged after the newest version went out');
+  assert.deepEqual(await pick(16), ['no_version', null]);
+  const w = await read(12);
+  assert.equal(w.live, '1.0.2');
+  assert.equal(w.released, '1.0.1');
+  assert.equal(w.partial, false);
+  assert.equal(w.task_id, '12');
+});
+
+test('a task marked done whose code never merged says so — the case this line exists for', async () => {
+  const { read } = setup();
+  for (const id of [20, 21]) {
+    const w = await read(id);
+    assert.equal(w.stage, 'not_merged', String(id));
+    assert.equal(w.version, null);
+  }
+});
+
+test('a task not yet done has nothing to place, and costs no registry read', async () => {
+  const { read, asked } = setup();
+  const w = await read(30);
+  assert.deepEqual(w, { task_id: '30', package: PKG, status: 'active', stage: null });
+  assert.deepEqual(asked, [], 'no packument, no tarball');
+});
+
+test('an id that is not a task answers null; one that is not a number is never queried', async () => {
+  const { read, pool } = setup();
+  assert.equal(await read(999), null);
+  for (const bad of ['1; DROP', '', null, '12a', '1234567890123']) assert.equal(await read(bad), null, String(bad));
+  assert.equal(pool.queries.length, 1, 'only the real id reached the database');
+});
+
+test('a registry that does not answer is a partial reading, said so', async () => {
+  const { read } = setup({ pkStatus: 500 });
+  const w = await read(12);
+  assert.equal(w.partial, true);
+  assert.equal(w.stage, 'no_version', 'with no notes nothing can be placed in a version');
+});
+
+test('the offered flag follows the deploy page: published before this hall ran it, and already released', async () => {
+  const { read } = setup({ latest: '1.0.4' });
+  const w = await read(13);
+  assert.equal(w.stage, 'not_live');
+  assert.equal(w.offered, true);
+});
+
+// ---- the route -----------------------------------------------------------------------
+
+function layers(read) {
+  const router = buildRouter({ read });
+  const layer = router.stack.find((l) => l.route && l.route.path === '/npm-release/task/:id');
+  return layer.route.stack.map((s) => s.handle);
+}
+function call(handler, id) {
+  return new Promise((resolve) => {
+    const res = { code: 200, status(c) { this.code = c; return this; }, json(v) { resolve({ status: this.code, body: v }); } };
+    Promise.resolve(handler({ params: { id } }, res)).catch((e) => resolve({ status: 'threw', body: e }));
+  });
+}
+
+test('the route asks only for a signed-in builder — nothing on the line is not already public', () => {
+  const handles = layers(async () => ({}));
+  assert.equal(handles.length, 2, 'requireBuilder, then the handler');
+  const src = fs.readFileSync(path.join(ROOT, 'modules/npm-release/routes/task-where.js'), 'utf8');
+  assert.match(src, /'\/npm-release\/task\/:id',\s*\n\s*api\.requireBuilder,\s*\n\s*async/);
+  assert.doesNotMatch(src, /requirePermission|api\.requireRank\(/);
+});
+
+test('the route: 400 for a non-number, 404 for no task, 500 plainly on a failed read', async () => {
+  const h = (read) => layers(read)[1];
+  assert.deepEqual((await call(h(async () => ({ stage: 'released' })), '12')).body, { stage: 'released' });
+  assert.equal((await call(h(async () => { throw new Error('no'); }), 'x')).status, 400);
+  assert.equal((await call(h(async () => null), '12')).status, 404);
+  const failed = await call(h(async () => { throw new Error('pool gone'); }), '12');
+  assert.equal(failed.status, 500);
+  assert.equal(failed.body.error.code, 'task_where_failed');
+  assert.doesNotMatch(JSON.stringify(failed.body), /pool gone/, 'the internal message stays in the log');
+});
+
+// ---- the widget ----------------------------------------------------------------------
+
+const WIDGET_SRC = fs.readFileSync(path.join(ROOT, 'modules/npm-release/public/task-widget.js'), 'utf8');
+
+function bootWidget(answer, { shown = null } = {}) {
+  const slot = { _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+  const listeners = {};
+  const asked = [];
+  const windowObj = {
+    OTBTaskShown: shown,
+    BongosClient: { createClient: () => ({ request: async (m, url) => { asked.push(url); return answer(url); } }) },
+  };
+  const documentObj = {
+    getElementById: (id) => (id === 'task-contrib' ? slot : null),
+    addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, Map, Promise, encodeURIComponent, String };
+  vm.createContext(sandbox);
+  vm.runInContext(WIDGET_SRC, sandbox, { filename: 'task-widget.js' });
+  const announce = (detail) => { windowObj.OTBTaskShown = detail; for (const fn of listeners['otb:task-shown'] || []) fn({ detail }); };
+  const settle = async () => { for (let i = 0; i < 6; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { slot, asked, announce, settle, win: windowObj };
+}
+const ok = (data) => ({ status: 200, ok: true, data });
+
+test('each stage reads as one plain sentence under the rail', async () => {
+  const cases = [
+    [{ stage: 'released', version: '1.19.1036', live: '1.19.1040' }, /In <b>1\.19\.1036<\/b> · running here · released to other projects\./],
+    [{ stage: 'live_unreleased', version: '1.19.1040', live: '1.19.1040' }, /In <b>1\.19\.1040<\/b> · running here · not released to other projects yet\./],
+    [{ stage: 'not_live', version: '1.19.1041' }, /In <b>1\.19\.1041<\/b> · published, not running here yet\./],
+    [{ stage: 'not_live', version: '1.19.1041', offered: true }, /not running here yet · already offered to other projects\./],
+    [{ stage: 'unversioned' }, /Merged, waiting for the next published version\./],
+    [{ stage: 'no_version' }, /Shipped, though no published version lists it — usually a change that needed no code/],
+    [{ stage: 'not_merged' }, /<b>Done, but not merged\.<\/b> The ledger marks this task done, and its code is not on main yet/],
+  ];
+  for (const [w, re] of cases) {
+    const b = bootWidget(() => ok(w));
+    b.announce({ id: '12', status: w.stage === 'not_merged' ? 'confirmed' : 'shipped' });
+    await b.settle();
+    assert.match(b.slot.innerHTML, re, w.stage);
+  }
+});
+
+test('a partial reading is said; a version is escaped; an unknown stage draws nothing', async () => {
+  const partial = bootWidget(() => ok({ stage: 'no_version', partial: true }));
+  partial.announce({ id: '12', status: 'shipped' });
+  await partial.settle();
+  assert.match(partial.slot.innerHTML, /\(a partial reading: the registry or the release notes could not be read\)/);
+
+  const evil = bootWidget(() => ok({ stage: 'released', version: '<img src=x>' }));
+  evil.announce({ id: '12', status: 'shipped' });
+  await evil.settle();
+  assert.match(evil.slot.innerHTML, /In <b>&lt;img src=x&gt;<\/b>/);
+
+  const odd = bootWidget(() => ok({ stage: 'somewhere-else' }));
+  odd.announce({ id: '12', status: 'shipped' });
+  await odd.settle();
+  assert.equal(odd.slot.innerHTML, '');
+});
+
+test('work not yet done asks nothing; a failure draws nothing rather than something wrong', async () => {
+  const idle = bootWidget(() => ok({ stage: 'released' }));
+  idle.announce({ id: '12', status: 'active' });
+  await idle.settle();
+  assert.deepEqual(idle.asked, []);
+  assert.equal(idle.slot.innerHTML, '');
+
+  for (const answer of [() => ({ status: 403, ok: false, data: null }), () => ({ status: 404, ok: false, data: null }), () => { throw new Error('offline'); }]) {
+    const b = bootWidget(answer);
+    b.announce({ id: '12', status: 'shipped' });
+    await b.settle();
+    assert.equal(b.slot.innerHTML, '');
+  }
+});
+
+test('one read per task, however often the page re-renders — and never for a task no longer shown', async () => {
+  const b = bootWidget(() => ok({ stage: 'released', version: '1.0.1' }));
+  b.announce({ id: '12', status: 'shipped' });
+  b.announce({ id: '12', status: 'shipped' });
+  await b.settle();
+  assert.deepEqual(b.asked, ['/api/bongos/npm-release/task/12']);
+
+  // The page moved on to another task while the first read was in flight.
+  let release;
+  const slow = bootWidget(() => new Promise((r) => { release = () => r(ok({ stage: 'released', version: '9.9.9' })); }));
+  slow.announce({ id: '12', status: 'shipped' });
+  slow.win.OTBTaskShown = { id: '13', status: 'active' };
+  release();
+  await slow.settle();
+  assert.equal(slow.slot.innerHTML, '', 'task 12\'s line is not written onto task 13\'s page');
+});
+
+test('a widget that loads after the first announcement still draws the line', async () => {
+  const b = bootWidget(() => ok({ stage: 'released', version: '1.0.1' }), { shown: { id: '12', status: 'shipped' } });
+  await b.settle();
+  assert.match(b.slot.innerHTML, /In <b>1\.0\.1<\/b>/);
+});
+
+// ---- the seam that puts it on the page -----------------------------------------------
+
+test('the module declares the task page section and ships its widget; the seam guard counts it wired', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/npm-release/module.json'), 'utf8'));
+  assert.deepEqual(manifest.contributes.uiSections, ['task-where']);
+  assert.ok(manifest.contributes.routes.includes('task-where'));
+  assert.ok(fs.existsSync(path.join(ROOT, 'modules/npm-release/public/task-widget.js')));
+  const guard = fs.readFileSync(path.join(ROOT, 'scripts/gds/seam-wiring-guard.js'), 'utf8');
+  assert.match(guard, /alternates: \(dir\) => \[path\.join\(dir, 'public', 'task-widget\.js'\)\]/);
+});
+
+test('the server injects task widgets just before task.js, and names no module doing it', () => {
+  const { injectModuleHallWidgets } = require('../src/bongos/serve-internal.js');
+  const page = '<body><script src="/builders/md-reader.js" defer></script><script src="/builders/task.js?v=abc" defer></script></body>';
+  const out = injectModuleHallWidgets(page, [{ key: 'npm-release', src: '/modules/npm-release/public/task-widget.js' }], 'task');
+  assert.ok(out.indexOf('/modules/npm-release/public/task-widget.js') < out.indexOf('/builders/task.js'), 'before the consumer, so its listener exists first');
+  assert.ok(out.indexOf('/builders/md-reader.js') < out.indexOf('task-widget.js'));
+  assert.match(out, /<script src="\/modules\/npm-release\/public\/task-widget\.js" defer><\/script>/);
+  assert.equal(injectModuleHallWidgets(page, [], 'task'), page, 'no module, no change');
+  const index = '<script src="/builders/builders.js?v=1"></script>';
+  assert.match(injectModuleHallWidgets(index, [{ key: 'x', src: '/m.js' }]), /^<script src="\/m\.js" defer><\/script><script src="\/builders\/builders\.js/, 'the index injection is unchanged');
+  const si = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+  assert.match(si, /hallWidgetScripts\(\{ isEnabled: isModuleEnabled, file: 'task-widget\.js' \}\),\s*\n\s*'task',/);
+});
+
+// ---- the fixes the first grade asked for ---------------------------------------------
+
+test('the installed release notes are read from disk once per process, not once per view', async () => {
+  const realRead = fs.readFileSync;
+  let reads = 0;
+  fs.readFileSync = function (p, ...rest) {
+    if (String(p).endsWith('release-notes.json')) reads++;
+    return realRead.call(this, p, ...rest);
+  };
+  try {
+    const { pool } = setup();
+    const fg = fakeHttpsGet({ [`${ORIGIN}/@bongos%2fcore`]: { status: 500, body: 'down' } });
+    for (let i = 0; i < 3; i++) {
+      // No installedNotes: the module's own default, which is the path every task view takes.
+      await readTaskWhere({ pool, id: 12, pkg: PKG, live: '1.0.2', get: fg.get, store: freshStore() });
+    }
+  } finally { fs.readFileSync = realRead; }
+  assert.equal(reads, 1, 'three task views, one disk read');
+});
+
+test('the widget keeps only the last few readings', async () => {
+  const b = bootWidget((url) => ok({ stage: 'released', version: url.split('/').pop() }));
+  for (let i = 1; i <= 12; i++) b.announce({ id: String(i), status: 'shipped' });
+  await b.settle();
+  b.announce({ id: '12', status: 'shipped' });
+  b.announce({ id: '1', status: 'shipped' });
+  await b.settle();
+  assert.equal(b.asked.filter((u) => u.endsWith('/12')).length, 1, 'a recent task is served from the cache');
+  assert.equal(b.asked.filter((u) => u.endsWith('/1')).length, 2, 'an old one was evicted and is read again');
+});