@bongos/core 1.19.1044 → 1.19.1046

package/tests/claim_action.mjs

@@ -0,0 +1,417 @@
+// tests/claim_action.mjs
+//
+// Task 1003458 — the hall has ONE claim/release action, and it answers every
+// refusal the server can give.
+//
+// Two halves:
+//   1. the refusal copy is COMPLETE — a drift guard reads the server's own
+//      throw sites and fails if a code exists that this file has no sentence
+//      for. That is what makes "a new surface needs no new refusal handling"
+//      a fact rather than a hope;
+//   2. the copies are GONE — work.js and goals-render.js no longer define their
+//      own, which is the deletion the refactor is proven by.
+//
+// Before this, both boards carried their own switch over 8 of the server's
+// codes, drifted in wording (the same refusal said "The board will refresh."
+// on /work and "Reloading." on /goals, and the goals copy had lost the
+// "Wait for it to ship." advice), and neither had a single test.
+//
+// Run:  node tests/claim_action.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+
+const CA = require('../modules/hall-ui/public/claim-action.js');
+const { friendlyClaimError, makeClaimAction, errCode, errDetails } = CA;
+
+const envelope = (code, details = {}, message = '') => ({ error: { code, message, details } });
+const GENERIC = /^The board could not complete that \(/;
+
+// == 1. the refusal copy is complete ========================================
+
+// The server's throw sites. Scraped, not hand-listed, so the guard cannot go
+// stale the way the two hand-written switches did.
+function serverRefusalCodes() {
+  const out = new Set();
+  for (const f of [
+    ['modules', 'lifecycle', 'db-claims.js'],
+    ['modules', 'lifecycle', 'goal-authz.js'],
+  ]) {
+    for (const m of read(...f).matchAll(/code:\s*'([A-Za-z_]+)'/g)) out.add(m[1]);
+  }
+  const routes = read('modules', 'lifecycle', 'routes', 'claims.js');
+  for (const m of routes.matchAll(/'(session_[a-z_]+|newcomer_must_ship_first)'/g)) out.add(m[1]);
+  return out;
+}
+
+// Batch-SHAPE errors, deliberately not this switch's job: a batch refusal is
+// rendered per item by task-lib.js's friendlyBatchReason, and `batch_failed`
+// has its own branch at both call sites (it must list the failing tasks, which
+// a single sentence cannot). Excluded explicitly so the guard stays loud about
+// everything else.
+const BATCH_SHAPE = new Set(['BATCH_FAILED', 'BATCH_EMPTY', 'BATCH_DUPLICATE_IDS']);
+
+await test('every server refusal code has a sentence — the drift guard', () => {
+  const codes = [...serverRefusalCodes()].filter((c) => !BATCH_SHAPE.has(c)).sort();
+  assert.ok(codes.length >= 14, `expected the scrape to find the refusal chain, got ${codes.length}`);
+  const unhandled = codes.filter((c) => GENERIC.test(friendlyClaimError(409, envelope(c))));
+  assert.deepEqual(unhandled, [],
+    `these server refusals fall through to the generic line — add a case in claim-action.js: ${unhandled.join(', ')}`);
+});
+
+await test('the five codes NEITHER board used to handle are covered', () => {
+  // The regression this task exists to close. Each of these rendered as
+  // "The board could not complete that (409). Try again." before the extraction.
+  for (const code of ['REBASE_REQUIRED', 'TASK_NOT_FOUND', 'OPEN_BLOCKER',
+                      'GOAL_MEMBERSHIP_REQUIRED', 'MODULE_CONFLICT']) {
+    const line = friendlyClaimError(409, envelope(code));
+    assert.doesNotMatch(line, GENERIC, `${code} still falls through`);
+    assert.ok(line.length > 20, `${code} needs a real sentence`);
+  }
+});
+
+await test('no refusal ever renders a raw object or undefined', () => {
+  for (const code of [...serverRefusalCodes()]) {
+    const line = friendlyClaimError(409, envelope(code));
+    assert.equal(typeof line, 'string');
+    assert.doesNotMatch(line, /\[object Object\]|undefined|null/);
+  }
+});
+
+await test('reads the ADR 0116 envelope AND the flat legacy shape', () => {
+  // task 1002462: `data.error` became an OBJECT and every string branch silently
+  // missed, so each refusal rendered as the generic line.
+  const viaEnvelope = friendlyClaimError(409, envelope('ALREADY_CLAIMED'));
+  const viaFlat = friendlyClaimError(409, { error: 'ALREADY_CLAIMED' });
+  assert.equal(viaEnvelope, viaFlat);
+  assert.doesNotMatch(viaEnvelope, GENERIC);
+});
+
+await test('the server\'s own hint wins where it names the task', () => {
+  // REBASE_REQUIRED and GOAL_MEMBERSHIP_REQUIRED carry a message that names the
+  // specific task or goal; a generic sentence would be strictly less useful.
+  const msg = 'Task #123 needs rebasing — run /strand-fix 123.';
+  assert.equal(friendlyClaimError(409, envelope('REBASE_REQUIRED', {}, msg)), msg);
+  // …and it still answers when the server sends none.
+  assert.doesNotMatch(friendlyClaimError(409, envelope('REBASE_REQUIRED')), GENERIC);
+});
+
+await test('TOUCHES_CONFLICT names the overlapping claims and keeps the advice', () => {
+  const line = friendlyClaimError(409, envelope('TOUCHES_CONFLICT', { conflicts: [{ title: 'Fix the pager' }] }));
+  assert.match(line, /Fix the pager/);
+  // The goals copy had dropped this half; it is the only part that tells the
+  // builder what to DO.
+  assert.match(line, /Wait for it to ship/);
+});
+
+await test('MODULE_CONFLICT names the module when the server sends one', () => {
+  assert.match(friendlyClaimError(409, envelope('MODULE_CONFLICT', { module_key: 'lifecycle' })), /"lifecycle"/);
+  assert.doesNotMatch(friendlyClaimError(409, envelope('MODULE_CONFLICT')), GENERIC);
+});
+
+await test('an unknown code still fails closed onto the generic line', () => {
+  assert.match(friendlyClaimError(409, envelope('SOMETHING_NEW_2027')), GENERIC);
+});
+
+// == 2. the action ==========================================================
+
+function harness({ fail = null } = {}) {
+  const posts = [], toasts = [];
+  let refreshes = 0;
+  const action = makeClaimAction({
+    postJSON: async (path, body) => {
+      posts.push({ path, body });
+      if (fail) throw fail;
+      return { ok: true };
+    },
+    toast: (m) => toasts.push(m),
+    refresh: async () => { refreshes += 1; },
+    API: '/api/bongos',
+  });
+  return { action, posts, toasts, r: () => refreshes };
+}
+
+await test('claim posts the task id and does NOT bind the session', () => {
+  const h = harness();
+  return h.action.claim(42).then(() => {
+    assert.deepEqual(h.posts, [{ path: '/api/bongos/claims', body: { task_id: 42, bind_session: false } }]);
+    assert.match(h.toasts[0], /#42/);
+    assert.equal(h.r(), 1, 'a success refreshes the board');
+  });
+});
+
+await test('release resolves the claim as abandoned (there is no DELETE /claims/:id)', () => {
+  const h = harness();
+  return h.action.release('c9', 42).then(() => {
+    assert.equal(h.posts[0].path, '/api/bongos/claims/c9/resolve');
+    assert.deepEqual(h.posts[0].body, { outcome: 'abandoned' });
+    assert.match(h.toasts[0], /Released #42/);
+  });
+});
+
+await test('a refusal toasts the MAPPED sentence, not the raw error', async () => {
+  const h = harness({ fail: Object.assign(new Error('x'), { status: 409, data: envelope('OPEN_BLOCKER') }) });
+  const out = await h.action.claim(42);
+  assert.equal(out.ok, false);
+  assert.equal(h.toasts[0], friendlyClaimError(409, envelope('OPEN_BLOCKER')));
+  assert.doesNotMatch(h.toasts[0], GENERIC);
+});
+
+await test('a 409 refreshes the board — it is showing something stale', async () => {
+  const h = harness({ fail: Object.assign(new Error('x'), { status: 409, data: envelope('ALREADY_CLAIMED') }) });
+  await h.action.claim(42);
+  assert.equal(h.r(), 1);
+});
+
+await test('a non-409 failure does NOT refresh', async () => {
+  const h = harness({ fail: Object.assign(new Error('x'), { status: 500, data: {} }) });
+  await h.action.claim(42);
+  assert.equal(h.r(), 0, 'a 500 says nothing about the board being stale');
+});
+
+await test('the auth-redirect sentinel is swallowed, never toasted', async () => {
+  const h = harness({ fail: new Error('redirecting to auth') });
+  const out = await h.action.claim(42);
+  assert.equal(out.redirected, true);
+  assert.deepEqual(h.toasts, [], 'a toast during a redirect is noise the builder never reads');
+});
+
+await test('a refresh that throws after a refusal does not mask the refusal', async () => {
+  const posts = [], toasts = [];
+  const action = makeClaimAction({
+    postJSON: async () => { throw Object.assign(new Error('x'), { status: 409, data: envelope('ALREADY_CLAIMED') }); },
+    toast: (m) => toasts.push(m),
+    refresh: async () => { throw new Error('network died'); },
+  });
+  const out = await action.claim(42);          // must not reject
+  assert.equal(out.ok, false);
+  assert.equal(toasts.length, 1, 'the refusal was still told');
+});
+
+await test('the dry run reports what a bulk claim WOULD do', async () => {
+  const action = makeClaimAction({
+    postJSON: async (path, body) => {
+      assert.equal(path, '/api/bongos/claims/batch/validate');
+      assert.deepEqual(body, { task_ids: [7, 8] });
+      return { parallel_safe: true, results: [{ task_id: 7, ok: true }] };
+    },
+    toast: () => {}, refresh: async () => {},
+  });
+  const out = await action.validateMany([7, 8]);
+  assert.equal(out.parallelSafe, true);
+  assert.equal(out.byId.get('7').ok, true);
+});
+
+await test('a dry run that FAILS answers "not safe, know nothing" — never throws, never toasts', async () => {
+  // The caller uses this to decide whether to offer a parallel prompt. Copying a
+  // prompt for tasks nobody could verify is worse than offering nothing, and an
+  // unavailable pre-check is not a refusal to report at the builder.
+  const toasts = [];
+  const action = makeClaimAction({
+    postJSON: async () => { throw Object.assign(new Error('down'), { status: 500 }); },
+    toast: (m) => toasts.push(m), refresh: async () => {},
+  });
+  const out = await action.validateMany([7]);
+  assert.equal(out.ok, false);
+  assert.equal(out.parallelSafe, false);
+  assert.equal(out.byId.size, 0);
+  assert.deepEqual(toasts, [], 'a best-effort pre-check must stay silent');
+});
+
+// == 3. the deletion ========================================================
+
+// The assertion that was MISSING in the first round, and the gap it left is the
+// whole reason this section exists: the shared action can be defined, unit-tested
+// and documented as the contract while every real call site still hand-rolls its
+// own POST + toast + refresh. Green tests, dead code, and a CLAUDE.md rule
+// describing behaviour the code does not have. Assert the call sites, not the
+// module.
+
+await test('NOBODY posts to /claims except through the shared action', () => {
+  // The falsifiable form of "proven by deletion". If a surface reintroduces its
+  // own claim POST, this fails — which is what "a new claim surface needs no new
+  // refusal handling" has to mean in practice.
+  const offenders = [];
+  for (const f of ['work.js', 'goals-page.js', 'goals-render.js', 'task.js']) {
+    const src = read('modules', 'hall-ui', 'public', f);
+    if (/postJSON\(\s*`\$\{API\}\/claims/.test(src)) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these still hand-roll a claim/release POST instead of calling claimAction: ${offenders.join(', ')}`);
+});
+
+await test('both boards CONSTRUCT the shared action, not just its error text', () => {
+  for (const f of ['work.js', 'goals-page.js']) {
+    const src = read('modules', 'hall-ui', 'public', f);
+    assert.match(src, /makeClaimAction\(\{/, `${f} must build the action`);
+    assert.match(src, /describeBatchReason: friendlyBatchReason/,
+      `${f} must inject the batch reason mapper, or a batch refusal loses its per-task detail`);
+  }
+});
+
+await test('every claim/release entry point routes through it', () => {
+  const sites = {
+    'work.js': ['doClaim', 'doRelease', 'doBulkClaim', 'doBulkRelease'],
+    'goals-page.js': ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim'],
+  };
+  for (const [f, fns] of Object.entries(sites)) {
+    const src = read('modules', 'hall-ui', 'public', f);
+    for (const fn of fns) {
+      const m = src.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n  \\}`));
+      assert.ok(m, `${f}: ${fn} not found`);
+      assert.match(m[0], /claimAction\.(claim|release|claimMany|releaseMany)\(/,
+        `${f}: ${fn} does not go through the shared action`);
+      assert.doesNotMatch(m[0], /friendlyClaimError\(/,
+        `${f}: ${fn} still maps its own refusal`);
+    }
+  }
+});
+
+await test('no call site reloads on top of the action\'s own refresh', async () => {
+  // The regression the extraction introduced on /goals: the action's injected
+  // refresh reloads the open goal's task list, and doGoalBulkClaim's finally
+  // reloaded it AGAIN — so every bulk claim there fetched and re-rendered
+  // twice. work.js's doBulkClaim is the correct shape: redraw the toolbar,
+  // never re-fetch. A finally that awaits a loader is the tell.
+  const src = read('modules', 'hall-ui', 'public', 'goals-page.js');
+  for (const fn of ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim']) {
+    const m = src.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n  \\}`));
+    assert.ok(m, `${fn} not found`);
+    assert.doesNotMatch(m[0], /finally \{[\s\S]*?await loadGoalTasks\(/,
+      `${fn}: the shared action already refreshed — this reloads a second time`);
+  }
+});
+
+await test('the action refreshes ONCE per call, not per outcome', async () => {
+  let refreshes = 0;
+  const mk = (postJSON) => makeClaimAction({
+    postJSON, toast: () => {}, refresh: async () => { refreshes += 1; },
+    describeBatchReason: (f) => f.reason,
+  });
+  await mk(async () => ({}))?.claimMany([7, 8]);
+  assert.equal(refreshes, 1, 'success');
+  refreshes = 0;
+  await mk(async () => { throw Object.assign(new Error('x'), { status: 409, data: envelope('batch_failed', { failures: [] }) }); }).claimMany([7, 8]);
+  assert.equal(refreshes, 1, 'batch refusal');
+  refreshes = 0;
+  await mk(async () => { throw Object.assign(new Error('x'), { status: 500, data: {} }); }).claimMany([7, 8]);
+  assert.equal(refreshes, 0, 'a 500 says nothing about the board being stale');
+});
+
+await test('the batch refusal still names the failing tasks', async () => {
+  // All-or-nothing: a batch_failed 409 means NOTHING was claimed, so a generic
+  // sentence leaves the builder with no idea what to deselect.
+  const toasts = [];
+  const action = makeClaimAction({
+    postJSON: async () => { throw Object.assign(new Error('x'), { status: 409, data: envelope('batch_failed', { failures: [{ task_id: 7, reason: 'ALREADY_CLAIMED' }] }) }); },
+    toast: (m) => toasts.push(m),
+    refresh: async () => {},
+    describeBatchReason: (f) => (f.reason === 'ALREADY_CLAIMED' ? 'already claimed' : f.reason),
+  });
+  await action.claimMany([7, 8]);
+  assert.match(toasts[0], /#7 \(already claimed\)/);
+  assert.doesNotMatch(toasts[0], GENERIC);
+});
+
+await test('a selection of ONE takes the single endpoint, not a batch of one', async () => {
+  const posts = [];
+  const action = makeClaimAction({
+    postJSON: async (path, body) => { posts.push(path); return {}; },
+    toast: () => {}, refresh: async () => {},
+  });
+  await action.claimMany([7]);
+  assert.equal(posts[0], '/api/bongos/claims', 'the batch route reports per-item reasons — wrong shape for one');
+  posts.length = 0;
+  await action.releaseMany([['c1', 7]]);
+  assert.equal(posts[0], '/api/bongos/claims/c1/resolve');
+});
+
+await test('a batch release counts rather than lists — it is NOT all-or-nothing', async () => {
+  const toasts = [];
+  const action = makeClaimAction({
+    postJSON: async () => ({ released: [1, 2], failures: [3] }),
+    toast: (m) => toasts.push(m), refresh: async () => {},
+  });
+  await action.releaseMany([['c1', 1], ['c2', 2], ['c3', 3]]);
+  assert.match(toasts[0], /Released 2 of 3 — 1 could not be released/);
+});
+
+await test('the refusal text is PLAIN TEXT, for textContent — never markup', () => {
+  // It interpolates server-controlled strings (module_key, conflict titles, the
+  // REBASE_REQUIRED/GOAL_MEMBERSHIP_REQUIRED messages). Every consumer passes it
+  // to toast(), which sets textContent; a future caller using innerHTML would
+  // turn that into an injection. Pinned here so the contract is checkable.
+  const line = friendlyClaimError(409, envelope('MODULE_CONFLICT', { module_key: '<img src=x onerror=alert(1)>' }));
+  assert.match(line, /<img src=x onerror=alert\(1\)>/, 'it does not escape — it is text, not markup');
+  for (const f of ['work.js', 'goals-page.js']) {
+    const src = read('modules', 'hall-ui', 'public', f);
+    assert.doesNotMatch(src, /innerHTML\s*=\s*[^;]*friendlyClaimError/, `${f} must not render it as markup`);
+  }
+});
+
+await test('work.js no longer defines its own refusal switch', () => {
+  const src = read('modules', 'hall-ui', 'public', 'work.js');
+  assert.doesNotMatch(src, /function friendlyActionError/);
+  assert.match(src, /window\.OTBClaimAction/, 'it must consume the shared one');
+});
+
+await test('goals-render.js no longer defines its own', () => {
+  const src = read('modules', 'hall-ui', 'public', 'goals-render.js');
+  assert.doesNotMatch(src, /function friendlyClaimError/);
+  assert.doesNotMatch(src, /function errCode/, 'its envelope readers were a third copy');
+  assert.match(src, /window\.OTBClaimAction/);
+});
+
+await test('both boards load claim-action.js BEFORE the script that destructures it', () => {
+  for (const [page, consumer] of [['work.html', 'work.js'], ['goals.html', 'goals-render.js']]) {
+    const html = read('modules', 'hall-ui', 'public', page);
+    const shared = html.indexOf('claim-action.js');
+    const after = html.indexOf(consumer + '?v=');
+    assert.ok(shared > -1, `${page} must load claim-action.js`);
+    assert.ok(after > shared, `${page}: ${consumer} must load AFTER claim-action.js`);
+  }
+});
+
+await test('the cache-bust moved on every page whose script changed', () => {
+  // A fix that reaches nobody looks identical to a fix that does not work.
+  for (const [page, scripts] of [
+    ['work.html', ['work.js']],
+    ['goals.html', ['goals-render.js', 'goals-page.js']],
+  ]) {
+    const html = read('modules', 'hall-ui', 'public', page);
+    for (const s of scripts) {
+      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-26-claimaction1'), `${page}: ${s} not busted`);
+    }
+  }
+});
+
+await test('task.js keeps its own LIFECYCLE mapper — a disjoint code set', () => {
+  // Deliberately NOT merged: it maps POST /tasks/:id/ship + /confirm refusals
+  // (task_not_confirmed, verify_attestation_required), which share no code with
+  // the claim gate. One switch over both would be wrong about half its cases.
+  const src = read('modules', 'hall-ui', 'public', 'task.js');
+  assert.match(src, /function friendlyActionError/);
+  assert.match(src, /task_not_confirmed/);
+  assert.doesNotMatch(src, /case 'ALREADY_CLAIMED'/);
+});
+
+await test('the module is dependency-free and node-require-safe', () => {
+  const src = read('modules', 'hall-ui', 'public', 'claim-action.js');
+  // It may PUBLISH window.OTBClaimAction; it must not READ any other toolkit
+  // global, or load order stops being "before the page script".
+  const others = [...src.matchAll(/window\.OTB([A-Za-z]+)/g)].map((m) => m[1]).filter((n) => n !== 'ClaimAction');
+  assert.deepEqual(others, [], `reaches for other globals: ${others.join(', ')}`);
+  assert.ok(typeof errCode === 'function' && typeof errDetails === 'function');
+});
+
+summary();

package/tests/core_upgrade_owner_door.mjs

@@ -28,7 +28,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 // The session double must be installed BEFORE auth.js loads: auth.js destructures
-// lookupSession at require time (the tests/scouting_page_gate.mjs precedent).
+// lookupSession at require time (the tests/page_gate_second_door.mjs precedent).
 const dbKernel = require('../src/bongos/db-kernel.js');
 let nextSession = null;
 dbKernel.lookupSession = async () => nextSession;

package/tests/edit_hints.mjs

@@ -21,7 +21,7 @@ const hints = require(HOOK);
 
 test('each generator input maps to its generator; unrelated paths map to nothing', () => {
   const cases = [
-    ['modules/hall-ui/public/people.js', 'copy-inventory.js'],
+    ['modules/hall-ui/public/roster.js', 'copy-inventory.js'],
     ['modules/status-ui/public/index.html', 'copy-inventory.js'],
     ['src/bongos/auth.js', 'gen-repo-map.js'],
     ['modules/lifecycle/routes/claims.js', 'gen-api-docs.js'],
@@ -39,12 +39,12 @@ test('each generator input maps to its generator; unrelated paths map to nothing
 });
 
 test('rel() reconciles C:\\, C:/ and /c/ shapes between CLAUDE_PROJECT_DIR and file_path', () => {
-  const want = 'modules/hall-ui/public/people.js';
-  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\people.js', 'C:\\r\\repo'), want);
-  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\people.js', 'C:/r/repo'), want);
-  assert.equal(hints.rel('/c/r/repo/modules/hall-ui/public/people.js', 'C:\\r\\repo'), want);
-  assert.equal(hints.rel('c:/r/repo/modules/hall-ui/public/people.js', 'C:/r/repo/'), want);
-  assert.equal(hints.rel('/home/u/repo/modules/hall-ui/public/people.js', '/home/u/repo'), want);
+  const want = 'modules/hall-ui/public/roster.js';
+  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\roster.js', 'C:\\r\\repo'), want);
+  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\roster.js', 'C:/r/repo'), want);
+  assert.equal(hints.rel('/c/r/repo/modules/hall-ui/public/roster.js', 'C:\\r\\repo'), want);
+  assert.equal(hints.rel('c:/r/repo/modules/hall-ui/public/roster.js', 'C:/r/repo/'), want);
+  assert.equal(hints.rel('/home/u/repo/modules/hall-ui/public/roster.js', '/home/u/repo'), want);
 });
 
 test('run as a hook: prints one hint for a generator input, nothing for an unrelated file, exit 0 both times', () => {
@@ -53,7 +53,7 @@ test('run as a hook: prints one hint for a generator input, nothing for an unrel
     input: JSON.stringify({ tool_input: { file_path: path.join(projectDir, ...relPath.split('/')) } }),
     encoding: 'utf8', timeout: 15000, env: { ...process.env, CLAUDE_PROJECT_DIR: projectDir },
   });
-  const a = run('modules/hall-ui/public/people.js');
+  const a = run('modules/hall-ui/public/roster.js');
   assert.equal(a.status, 0, a.stderr);
   assert.match(a.stdout, /copy-registry\.json is now stale/);
   assert.match(a.stdout, /copy-inventory\.js/);

package/tests/effective_visibility_predicate.mjs

@@ -1122,7 +1122,7 @@ await ta('private accounts are absent from the leaderboard/directory rollup', as
   const rows = await pi.listScoutingRollup({ limit: 50, pool });
   const shown = rows.map((r) => r.github_login).sort();
   assert.deepEqual(shown, ['octo', 'shifted'],
-    'only active, publicly-visible, unhidden accounts reach /people and /scouting — '
+    'only active, publicly-visible, unhidden accounts reach /scouting — '
     + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private, legacy never accepted the terms (ADR 0213)`);
 });
 

package/tests/goal_category_ui.mjs

@@ -123,6 +123,9 @@ async function renderList() {
   windowObj.OTB.$ = $;
   windowObj.OTB.fmtDate = () => '';
   windowObj.OTB.toast = () => {};
+  // task 1003458: the page loads claim-action.js before this script; the stub
+  // must mirror that, or the destructure of window.OTBClaimAction throws.
+  vm.runInContext(read('modules/hall-ui/public/claim-action.js'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });

package/tests/goal_criterion_confirm_ui.mjs

@@ -153,6 +153,9 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  // task 1003458: the page loads claim-action.js before this script; the stub
+  // must mirror that, or the destructure of window.OTBClaimAction throws.
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/claim-action.js'), 'utf8'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });

package/tests/goal_forest_page.mjs

@@ -77,6 +77,9 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
   vm.runInContext(LIB_JS, sandbox, { filename: 'goal-forest-lib.js' });
   vm.runInContext(FIT_JS, sandbox, { filename: 'text-fit.js' });
   vm.runInContext(FOREST_RENDER_JS, sandbox, { filename: 'goal-forest-render.js' });
+  // task 1003458: the page loads claim-action.js before this script; the stub
+  // must mirror that, or the destructure of window.OTBClaimAction throws.
+  vm.runInContext(read('claim-action.js'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(RENDER_JS, sandbox, { filename: 'goals-render.js' });
 
   const state = { current: 7, forest: null, forestError: false };

package/tests/goal_invite_consent.mjs

@@ -169,7 +169,9 @@ function harness({ pendingRequests = [] } = {}) {
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
-  for (const f of ['hall-kit.js', 'task-lib.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
+  // task 1003458: claim-action.js sits between task-lib and goals-render on the
+  // real page (goals.html); the stub mirrors that order.
+  for (const f of ['hall-kit.js', 'task-lib.js', 'claim-action.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
     vm.runInContext(read(P + f), sandbox, { filename: f });
   }
 

package/tests/goal_mine_lens.mjs

@@ -147,6 +147,9 @@ async function boot({
   vm.runInContext(GOAL_FOREST_LIB_SRC, sandbox, { filename: 'goal-forest-lib.js' });
   windowObj.OTBGoalForestLib = sandbox.OTBGoalForestLib;
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });
+  // task 1003458: the page loads claim-action.js before this script; the stub
+  // must mirror that, or the destructure of window.OTBClaimAction throws.
+  vm.runInContext(hall('claim-action.js'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
   vm.runInContext(GOALS_PAGE_SRC, sandbox, { filename: 'goals-page.js' });
   for (let i = 0; i < 30; i += 1) await new Promise((r) => setTimeout(r, 0));

package/tests/government_parity.mjs

@@ -280,7 +280,7 @@ function parsePageGates(src) {
   // Each entry's own object literal is bounded by [^}]* so the scan cannot run past a
   // gate that lacks a `permission` key and silently adopt the NEXT gate's. `permission`
   // is then found ANYWHERE inside that literal rather than assumed to come first —
-  // requireProjectCuratePage already carries a second key, and key order in an object
+  // every gate carries a `deniedTo` beside it, and key order in an object
   // literal is not a contract anyone maintains.
   for (const m of block[1].matchAll(/(require[A-Za-z]*Page):\s*Object\.freeze\(\{([^}]*)\}\)/g)) {
     const perm = m[2].match(/permission:\s*'([^']+)'/);

package/tests/hall_builders_page_pass.mjs

@@ -223,9 +223,9 @@ test('B: a payload with no id degrades to the place alone', async () => {
 });
 
 test('B: the id wears the same mono/faint voice as the login', () => {
-  const css = read('people.css');
+  const css = read('roster.css');
   const i = css.indexOf('.ledger__place .ledger__id {');
-  assert.ok(i > 0, 'people.css styles the roster id');
+  assert.ok(i > 0, 'roster.css styles the roster id');
   const block = css.slice(i, css.indexOf('}', i));
   for (const token of ['var(--font-mono)', 'var(--ink-faint)']) {
     assert.ok(block.includes(token), `the id spends ${token}, the voice .dir-login already uses`);

package/tests/hall_mine_lens.mjs

@@ -201,6 +201,9 @@ function bootWorkBoard({ signedIn = true, goalsFail = false } = {}) {
   vm.runInContext(WORK_SUMMARY_JS, sandbox, { filename: 'work-summary.js' });
   windowObj.OTBMineLens = sandbox.OTBMineLens;
   windowObj.OTBWorkSummary = sandbox.OTBWorkSummary;
+  // task 1003458: the page loads claim-action.js before this script; the stub
+  // must mirror that, or the destructure of window.OTBClaimAction throws.
+  vm.runInContext(fs.readFileSync(path.join(HALL, 'claim-action.js'), 'utf8'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(WORK_JS, sandbox, { filename: 'work.js' });
   (documentObj.listeners.DOMContentLoaded || []).forEach((fn) => fn());
 

package/tests/hall_nav.mjs

@@ -266,10 +266,9 @@ test('sidebar groups read by audience, in order', () => {
   assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'ideas', 'thinking', 'copy-desk', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
-  // People (task 1002577): the /scouting directory graduated into the hall.
-  // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
-  // so the nav entry reads 'government' since ADR 0174 (it said 'archon', then
-  // was stricter than the wall). requireProjectCuratePage is the wall server-side.
+  // task 1003444: 'people' LEFT the group — the owner deleted the hall's
+  // cross-project directory (ADR 0337 D5); its home is the hub, and /people
+  // redirects to /roster. Builders is the hall's directory now.
   // task 1003172 (C02 of goal 1000075): 'collab' joins Community, FIRST. The
   // group is picked by whose data it is, and a help request is another builder
   // reaching you — not your own numbers (that is You), and not reference (Docs).
@@ -280,7 +279,8 @@ test('sidebar groups read by audience, in order', () => {
   // changed: it was a hash view on index.html (href /#leaderboard, view:
   // 'leaderboard') and is now a real page at /roster labelled Builders. That is
   // what made this group read as one real page plus a link into the home page.
-  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster', 'people'], 'Community = everyone else');
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster'], 'Community = everyone else, in this project');
+  assert.ok(!nav.flatMap((g) => g.items).some((i) => /^\/people\b/.test(i.href)), 'no nav item points at the deleted /people');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
@@ -343,11 +343,11 @@ test('THE CORRECTION: Community shows a xenos two items, Collab and Builders', (
 test('neither Community page hides behind a rank the page itself does not enforce', () => {
   // The invariant this task exists to restore: a nav flag may be narrower than
   // the wall for cosmetic reasons (/profile does it), but it must never assert a
-  // RANK the page gate does not. /people keeps its rank flag legitimately — it
-  // fronts project.curate, which requireProjectCuratePage really does enforce.
+  // RANK the page gate does not. /people was the one item with a legitimate rank
+  // flag; it left the hall in task 1003444, so the group now carries none.
   const community = parseNav(boot().sidebarHtml).find((g) => g.label === 'Community');
   const ranked = community.items.filter((i) => RANK_GATES.has(i.gate)).map((i) => i.id);
-  assert.deepEqual(ranked, ['people'], 'only /people carries a rank flag, and its API enforces one');
+  assert.deepEqual(ranked, [], 'no Community item carries a rank flag');
 });
 
 test('no group head is gated wider than its own items', () => {