@bongos/core 1.19.1045 → 1.19.1047

package/tests/go_live.mjs

@@ -595,15 +595,22 @@ const phaseC = ({ timer = true, pin = '', version = '1.19.306', installed = '1.1
   '##END##',
 ].filter(Boolean).join('\n');
 
-// Records every script fed to a shell. `upgradeFails` drives the rollback path.
-function fakeShell({ upgradeFails = false, phaseCOut = phaseC() } = {}) {
+// Records every script fed to a shell. `upgradeFails` drives the rollback path;
+// `rehearsalRefuses` makes the --dry-run pre-flight say no (task 1004306).
+function fakeShell({ upgradeFails = false, rehearsalRefuses = false, backupFails = false, pruned = '0', phaseCOut = phaseC() } = {}) {
   const scripts = [];
   const fn = (cmd, args, opts = {}) => {
     const input = opts.input || '';
     scripts.push(input);
+    if (backupFails && input.includes('##BACKUP##')) return { status: 1, stdout: '##TIMER##\n##BACKUP##\n', stderr: 'pg_dump: error: connection to server failed' };
+    if (input.includes('bongos upgrade') && input.includes('--dry-run')) {
+      return rehearsalRefuses
+        ? { status: 1, stdout: '', stderr: "\n✖ 5 unresolved artist reviews hold this deploy — the project runs artist_gate 'strict'\n" }
+        : { status: 0, stdout: '  [dry-run] would pin', stderr: '' };
+    }
     if (input.includes('bongos upgrade')) return { status: upgradeFails ? 1 : 0, stdout: '', stderr: upgradeFails ? 'boom' : '' };
     if (input.includes('##PIN##')) return { status: 0, stdout: phaseCOut, stderr: '' };
-    return { status: 0, stdout: '##TIMER##\n##BACKUP##\n##END##', stderr: '' };
+    return { status: 0, stdout: `##TIMER##\n##BACKUP##\n${input.includes('##PRUNE##') ? `##PRUNE##\n${pruned}\n` : ''}##END##`, stderr: '' };
   };
   fn.scripts = scripts;
   fn.all = () => scripts.join('\n');
@@ -660,7 +667,7 @@ test('with no deployTimer, nothing is stopped, started, or reported as restarted
   assert.ok(!/systemctl (stop|start)/.test(run.all()), 'must not touch a timer it has not got');
   assert.ok(!run.all().includes('undefined'), 'no field may interpolate as undefined');
   assert.ok(!stepNames(r).some((n) => /restart/.test(n)), 'no restart step for a timer that does not exist');
-  assert.match(stepNames(r)[0], /^backup \(no pull-deploy timer\)$/);
+  assert.match(stepNames(r)[1], /^backup \(no pull-deploy timer\)$/);
 });
 
 test('the platform instance still stops the timer and puts it back', () => {
@@ -728,3 +735,135 @@ test('the shipped co-tenant template is itself valid config', () => {
   assert.equal(sel.target.pinMode, 'local-commit');
   assert.equal(sel.target.deployTimer, undefined);
 });
+
+// ---------------------------------------------------------------------------
+// Refuse before you copy; keep ten (task 1004306)
+//
+// On cloudbongos.com, 2026-09-26, the artist gate refused two upgrades at 17:10 and
+// 17:15 UTC — and each had already stopped the deploy timer and written a 65 MB
+// pg_dump, because the backup was Phase A and the refusal lived inside Phase B.
+// Nothing pruned the directory (37 dumps, 1.7 GB, at about one attempt a day). At a
+// fifteen-minute cadence that fills the disk in about three days.
+// ---------------------------------------------------------------------------
+
+const withBackup = { ...okTarget, backupDb: 'instdb', backupDir: '~/backups', runAs: 'me' };
+
+test('a refused rehearsal stops the go-live before any timer is stopped or any dump is written', () => {
+  const run = fakeShell({ rehearsalRefuses: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+
+  assert.equal(r.ok, false);
+  assert.equal(r.failedAt, 'PREFLIGHT');
+  assert.equal(r.refused, true);
+  assert.equal(run.scripts.length, 1, 'the rehearsal is the only thing that may run');
+  assert.ok(!/pg_dump/.test(run.all()), 'no backup may be written for a refused move');
+  assert.ok(!/systemctl stop/.test(run.all()), 'the deploy timer must be left running');
+  assert.deepEqual(stepNames(r), ['pre-flight (the upgrade, rehearsed with --dry-run)']);
+});
+
+test('the rehearsal is the REAL upgrade command plus --dry-run, and it runs first', () => {
+  const run = fakeShell();
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true, `expected a clean run, got ${JSON.stringify(r.steps)}`);
+
+  // Same flags as the bump, so it asks exactly the gates the bump will ask — a
+  // rehearsal of a different command would be a check of something else.
+  assert.ok(run.scripts[0].includes(`${G.upgradeCommand(withBackup, '1.19.306')} --dry-run`));
+  const order = (needle) => run.scripts.findIndex((s) => s.includes(needle));
+  assert.ok(order('--dry-run') < order('pg_dump'), 'rehearse before the backup');
+  assert.ok(order('--dry-run') < order('systemctl stop'), 'rehearse before the timer stops');
+  assert.ok(order('pg_dump') < run.scripts.findIndex((s) => s.includes('bongos upgrade') && !s.includes('--dry-run')), 'the backup still precedes the real bump');
+});
+
+test('a refusal renders as "nothing changed", never as an unpushed pin', () => {
+  const run = fakeShell({ rehearsalRefuses: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  const out = G.renderReport(r);
+  assert.match(out, /Nothing changed — still on 1\.19\.300\. No timer was stopped and no backup was written\./);
+  assert.match(out, /5 unresolved artist reviews hold this deploy/, "the upgrade's own reason is shown");
+  assert.ok(!/pin committed/.test(out), 'no pin line for a bump that never started');
+});
+
+test('a successful dump is followed by a prune, and the step says what it removed', () => {
+  const run = fakeShell({ pruned: '3' });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true);
+  const phaseA = run.scripts.find((s) => s.includes('##BACKUP##'));
+  assert.ok(phaseA.indexOf('##PRUNE##') > phaseA.indexOf('pg_dump'), 'prune only after the dump');
+  const step = r.steps.find((s) => /prune/.test(s.name));
+  assert.equal(step.name, `prune old pre-upgrade backups (keep the newest ${G.PRE_UPGRADE_KEEP})`);
+  assert.equal(step.detail, 'removed 3');
+  assert.equal(G.PRE_UPGRADE_KEEP, 10);
+});
+
+test('no backupDb, no dump, and no prune', () => {
+  const run = fakeShell();
+  const r = G.applyGoLive(okTarget, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true);
+  assert.ok(!/##PRUNE##/.test(run.all()));
+  assert.ok(!r.steps.some((s) => /prune/.test(s.name)));
+});
+
+test('a prune that cannot run warns and does not fail the deploy', () => {
+  const step = G.pruneStep('prune exited non-zero');
+  assert.equal(step.ok, true, 'the dump is good; tidiness must not cost the deploy');
+  assert.equal(step.warn, true);
+  assert.match(step.detail, /could not prune \(prune exited non-zero\)/);
+  assert.equal(G.pruneStep(null).warn, true, 'a missing section is not "nothing to remove"');
+  assert.equal(G.pruneStep('0').detail, 'nothing to remove');
+  assert.match(G.renderReport({ targetName: 'x', from: 'a', to: 'b', ok: true, steps: [step] }), /⚠ prune old pre-upgrade backups/);
+});
+
+test('the dump fails when pg_dump fails, and a failed dump puts the stopped timer back', () => {
+  // The composed command: pipefail inside, and the partial file removed on failure.
+  const run = fakeShell();
+  G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  const phaseA = run.scripts.find((s) => s.includes('##BACKUP##'));
+  assert.ok(phaseA.includes('bash -c "set -o pipefail; mkdir -p ~/backups && { pg_dump instdb | gzip > ~/backups/pre-1.19.306-$TS.sql.gz || { rm -f ~/backups/pre-1.19.306-$TS.sql.gz; exit 1; }; }"'), phaseA);
+  assert.match(phaseA, /^TS="\$\(date -u \+%Y%m%dT%H%M%SZ\)"$/m, 'one timestamp for the dump and its cleanup');
+
+  const failing = fakeShell({ backupFails: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run: failing });
+  assert.equal(r.ok, false);
+  assert.equal(r.failedAt, 'PREPARE');
+  assert.ok(!failing.scripts.some((s) => s.includes('bongos upgrade') && !s.includes('--dry-run')), 'no bump without a backup');
+  assert.match(failing.scripts[failing.scripts.length - 1], /systemctl start inst-deploy\.timer/, 'the stopped timer is restarted');
+});
+
+// The prune command itself, run for real in a scratch directory. The composed-string
+// tests above cannot tell a glob that matches nothing from one that matches too much.
+test('the prune keeps the newest ten by time, and leaves every other file alone', { skip: process.platform === 'win32' && 'needs a POSIX shell' }, async () => {
+  const { spawnSync } = await import('node:child_process');
+  const os = await import('node:os');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'golive-prune-'));
+  try {
+    const dumps = [];
+    // 13 dumps, oldest first, whose NAME order disagrees with their TIME order.
+    for (let i = 0; i < 13; i++) {
+      const name = `pre-1.19.${i % 2 ? 99 - i : 100 + i}-202609${String(10 + i).padStart(2, '0')}T000000Z.sql.gz`;
+      const f = path.join(dir, name);
+      fs.writeFileSync(f, 'x');
+      const t = Date.UTC(2026, 8, 10 + i) / 1000;
+      fs.utimesSync(f, t, t);
+      dumps.push(name);
+    }
+    const others = ['pre-lane-sweep-20260823T203810Z.sql.gz', 'cloudbongos-2026-09-26T040000Z.sql.gz', 'notes.txt'];
+    for (const o of others) {
+      fs.writeFileSync(path.join(dir, o), 'x');
+      fs.utimesSync(path.join(dir, o), 1, 1); // older than every dump
+    }
+
+    const res = spawnSync('sh', ['-c', G.pruneCommand(dir)], { encoding: 'utf8' });
+    assert.equal(res.status, 0, res.stderr);
+    assert.equal(res.stdout.trim(), '3');
+    const left = new Set(fs.readdirSync(dir));
+    for (const d of dumps.slice(0, 3)) assert.ok(!left.has(d), `${d} is one of the three oldest and must go`);
+    for (const d of dumps.slice(3)) assert.ok(left.has(d), `${d} is one of the newest ten and must stay`);
+    for (const o of others) assert.ok(left.has(o), `${o} is not a pre-upgrade dump and must never be pruned`);
+
+    // A second run has nothing left to do.
+    assert.equal(spawnSync('sh', ['-c', G.pruneCommand(dir)], { encoding: 'utf8' }).stdout.trim(), '0');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/government_parity.mjs

@@ -280,7 +280,7 @@ function parsePageGates(src) {
   // Each entry's own object literal is bounded by [^}]* so the scan cannot run past a
   // gate that lacks a `permission` key and silently adopt the NEXT gate's. `permission`
   // is then found ANYWHERE inside that literal rather than assumed to come first —
-  // requireProjectCuratePage already carries a second key, and key order in an object
+  // every gate carries a `deniedTo` beside it, and key order in an object
   // literal is not a contract anyone maintains.
   for (const m of block[1].matchAll(/(require[A-Za-z]*Page):\s*Object\.freeze\(\{([^}]*)\}\)/g)) {
     const perm = m[2].match(/permission:\s*'([^']+)'/);

package/tests/hall_builders_page_pass.mjs

@@ -223,9 +223,9 @@ test('B: a payload with no id degrades to the place alone', async () => {
 });
 
 test('B: the id wears the same mono/faint voice as the login', () => {
-  const css = read('people.css');
+  const css = read('roster.css');
   const i = css.indexOf('.ledger__place .ledger__id {');
-  assert.ok(i > 0, 'people.css styles the roster id');
+  assert.ok(i > 0, 'roster.css styles the roster id');
   const block = css.slice(i, css.indexOf('}', i));
   for (const token of ['var(--font-mono)', 'var(--ink-faint)']) {
     assert.ok(block.includes(token), `the id spends ${token}, the voice .dir-login already uses`);

package/tests/hall_nav.mjs

@@ -266,10 +266,9 @@ test('sidebar groups read by audience, in order', () => {
   assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'ideas', 'thinking', 'copy-desk', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
-  // People (task 1002577): the /scouting directory graduated into the hall.
-  // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
-  // so the nav entry reads 'government' since ADR 0174 (it said 'archon', then
-  // was stricter than the wall). requireProjectCuratePage is the wall server-side.
+  // task 1003444: 'people' LEFT the group — the owner deleted the hall's
+  // cross-project directory (ADR 0337 D5); its home is the hub, and /people
+  // redirects to /roster. Builders is the hall's directory now.
   // task 1003172 (C02 of goal 1000075): 'collab' joins Community, FIRST. The
   // group is picked by whose data it is, and a help request is another builder
   // reaching you — not your own numbers (that is You), and not reference (Docs).
@@ -280,7 +279,8 @@ test('sidebar groups read by audience, in order', () => {
   // changed: it was a hash view on index.html (href /#leaderboard, view:
   // 'leaderboard') and is now a real page at /roster labelled Builders. That is
   // what made this group read as one real page plus a link into the home page.
-  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster', 'people'], 'Community = everyone else');
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster'], 'Community = everyone else, in this project');
+  assert.ok(!nav.flatMap((g) => g.items).some((i) => /^\/people\b/.test(i.href)), 'no nav item points at the deleted /people');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
@@ -343,11 +343,11 @@ test('THE CORRECTION: Community shows a xenos two items, Collab and Builders', (
 test('neither Community page hides behind a rank the page itself does not enforce', () => {
   // The invariant this task exists to restore: a nav flag may be narrower than
   // the wall for cosmetic reasons (/profile does it), but it must never assert a
-  // RANK the page gate does not. /people keeps its rank flag legitimately — it
-  // fronts project.curate, which requireProjectCuratePage really does enforce.
+  // RANK the page gate does not. /people was the one item with a legitimate rank
+  // flag; it left the hall in task 1003444, so the group now carries none.
   const community = parseNav(boot().sidebarHtml).find((g) => g.label === 'Community');
   const ranked = community.items.filter((i) => RANK_GATES.has(i.gate)).map((i) => i.id);
-  assert.deepEqual(ranked, ['people'], 'only /people carries a rank flag, and its API enforces one');
+  assert.deepEqual(ranked, [], 'no Community item carries a rank flag');
 });
 
 test('no group head is gated wider than its own items', () => {

package/tests/hall_page_gate_map.mjs

@@ -36,7 +36,6 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 // functions in src/bongos/auth.js):
 //   requireBuilderPage          page.view.public      any signed-in builder (xenos+)
 //   requireGovernmentPage       page.view.government  metic+   (ADR 0157)
-//   requireProjectCuratePage    project.curate        metic+
 //   requireBoardVotePage        board.vote.cast       xenos+   (ADR 0266)
 // That list is now CHECKED, not just written: "every page gate is dispatched"
 // below reads the gate table out of auth.js and fails if a gate here guards no
@@ -107,12 +106,13 @@ const ORACLE = {
   // The fleet cost page (task 1001949), on the atom its one read checks.
   '/builders/fleet': 'requireFleetPage',
 
-  // Metic+ via the `project.curate` atom — the exact permission GET /scouting
-  // checks, so the page can never drift wider than the API it fronts. Its
-  // legacy twin /builders/scouting is gone (task 1003440): the URL now 301s to
-  // /people before this dispatch runs, so it holds no gate and has no row —
-  // tests/hall_roster_world.mjs owns the proof that the redirect is there.
-  '/builders/people': 'requireProjectCuratePage',
+  // Gone (task 1003444, owner call 2026-09-25 — ADR 0337 D5): the cross-project
+  // directory left the hall, and /people now redirects to /roster before this
+  // dispatch runs, like its legacy twin /scouting (task 1003440).
+  // tests/hall_roster_world.mjs owns the proof that the redirect is there. The
+  // page gate that fronted it (requireProjectCuratePage) went with it; what
+  // still holds is GET /scouting's own gate, in the platform-identity module.
+  '/builders/people': null,
 
   // Metic+ since R16 (goal 1000069): the Government page is three rooms —
   // Permissions · Board Room · Constitution (reordered, task 1003269) — and only
@@ -138,8 +138,8 @@ const ORACLE = {
   // /roster joins them (task 1003441): it is this project’s own ledger, and its
   // one data source — GET /leaderboard — is deliberately unauthenticated,
   // mirroring the public status surface. The page must not be gated tighter than
-  // the API it fronts, which is the same rule that puts /people at
-  // project.curate. It was reachable to a stranger as the #leaderboard view on
+  // the API it fronts, which is the same rule that puts /deploy at
+  // core.pin.move. It was reachable to a stranger as the #leaderboard view on
   // the ungated index, so this preserves the audience rather than widening it.
   '/builders/roster': null,
   '/builders/': null,
@@ -310,6 +310,9 @@ const GONE_PAGES = {
   // Task 1004231 — the ideator's sky replaced both the room and the old sky with
   // one page at /thinking; /sky is a 301 to it, not a page.
   '/builders/sky': 'task 1004231 — the sky lives at /thinking now; /sky redirects there',
+  // Task 1003444 — the owner deleted the hall's cross-project directory; the hub
+  // community page (task 1003363) is its home, and /people redirects to /roster.
+  '/builders/people': 'task 1003444 — the hall has no cross-project directory; /people redirects to /roster',
 };
 
 test('a row that is null because the page left the hall serves no page', () => {
@@ -344,8 +347,8 @@ const AUTH_SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/auth.js'), 'utf8');
 function readPageGateNames(src) {
   const table = /const PAGE_GATES = Object\.freeze\(\{([\s\S]*?)\n\}\);/.exec(src);
   assert.ok(table, 'PAGE_GATES is still a `const PAGE_GATES = Object.freeze({…});` literal');
-  // Entry keys sit at exactly one indent level; `permission:` / `deniedTo:` /
-  // `alsoAdmits:` are nested deeper, so the two-space anchor keeps them out.
+  // Entry keys sit at exactly one indent level; `permission:` / `deniedTo:`
+  // are nested deeper, so the two-space anchor keeps them out.
   return [...table[1].matchAll(/^ {2}(require\w+):/gm)].map((m) => m[1]);
 }
 

package/tests/hall_roster_world.mjs

@@ -5,10 +5,10 @@
 // in the open and the rest behind the kit's disclosure, the readiness is the
 // family's figure band in the same dot language as the roll line, the view
 // toggle is a view and not a filter, the accent lands on the one live door; the
-// legacy /scouting door is deleted and its URL redirects onto the one directory
-// page (task 1003440), which shows the avatar, the name and the login
-// the API returns; the session ledger drops the nowrap + wrapper pair that broke
-// its sticky header, makes every id a door, and names its floor from the pack.
+// cross-project directory is gone from the hall — /scouting was deleted by task
+// 1003440 and /people by task 1003444, and both URLs now land on /roster; the
+// session ledger drops the nowrap + wrapper pair that broke its sticky header,
+// makes every id a door, and names its floor from the pack.
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
@@ -156,8 +156,8 @@ test('goals: the card is the row folded — no box, one fact source, the subtitl
   assert.match(read('goals-page.js'), /gr-row gr-row--skel/, 'the boot skeleton is row-shaped');
 });
 
-test('goals.css and people.css spend only the fifteen, and every token they name exists', () => {
-  for (const f of ['goals.css', 'people.css']) {
+test('goals.css and roster.css spend only the fifteen, and every token they name exists', () => {
+  for (const f of ['goals.css', 'roster.css']) {
     const css = read(f);
     noAlias(css, f);
     tokensDefined(css, f);
@@ -165,89 +165,61 @@ test('goals.css and people.css spend only the fifteen, and every token they name
 });
 
 // =========================================================================
-// PEOPLE — one directory, one door
+// PEOPLE — deleted from the hall; both old doors land on /roster
 // =========================================================================
 
-// Task 1003470 made /scouting render people.html byte-for-byte; task 1003440
-// removes the door itself. Two URLs onto one directory is a surface to keep in
-// sync that no reader ever asked for — but the URL still has to answer, or a
-// bookmark on the old door 404s.
-test('the legacy /scouting door is deleted, and nothing scouting-shaped is left in the hall', () => {
-  for (const f of ['scouting.html', 'scouting.js', 'scouting.states.json', 'scouting.css']) {
-    assert.ok(!fs.existsSync(path.join(PUB, f)), f + ' is gone — one directory, one door');
+// Task 1003440 deleted the legacy /scouting door; task 1003444 deleted /people
+// itself (owner call, 2026-09-25 evening — ADR 0337 D5): cross-project discovery
+// belongs to the hub, and the hall's directory is /roster. Both URLs still have
+// to answer, or a bookmark 404s.
+test('the /people page and its legacy /scouting door are deleted, and nothing of either is left in the hall', () => {
+  for (const f of ['scouting.html', 'scouting.js', 'scouting.states.json', 'scouting.css',
+    'people.html', 'people.js', 'people.states.json', 'people.css']) {
+    assert.ok(!fs.existsSync(path.join(PUB, f)), f + ' is gone — the hall carries no cross-project directory');
   }
 });
 
-test('the /scouting URL redirects to /people, and no dead gate dispatches to it', () => {
+test('the /people and /scouting URLs redirect to /roster, and no gate dispatches to either', () => {
   const serve = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8');
-  const i = serve.indexOf('const SCOUTING_LEGACY_RE');
-  assert.ok(i > 0, 'the retired URL keeps a matcher, so the bookmark still lands somewhere');
-  const block = serve.slice(i, i + 1200);
-  assert.ok(block.includes('res.redirect(301,'), 'and answers with a permanent redirect');
-  assert.ok(block.includes("/people"), 'pointing at the directory that replaced it');
+  const decl = 'const RETIRED_DIRECTORY_RE = ';
+  const i = serve.indexOf(decl);
+  assert.ok(i > 0, 'the retired URLs keep a matcher, so a bookmark still lands somewhere');
+  const block = serve.slice(i, i + 900);
+  // 302, not 301: /roster is the interim target until the hub community page
+  // (task 1003363) ships, and a browser caches a 301 past any re-point.
+  assert.ok(block.includes('res.redirect(302,'), 'and answers with a temporary redirect');
+  assert.ok(block.includes('/roster'), 'pointing at the in-project directory that remains');
   // RUN the shipped matcher, rather than trusting that it reads right. Anchoring
   // is the half that goes wrong: an unanchored twin would swallow the API route.
-  const decl = 'const SCOUTING_LEGACY_RE = ';
-  const j = serve.indexOf(decl);
-  const rx = eval(serve.slice(j + decl.length, serve.indexOf(';', j))); // eslint-disable-line no-eval
-  for (const p of ['/builders/scouting', '/builders/scouting/', '/builders/scouting.html']) {
+  const rx = eval(serve.slice(i + decl.length, serve.indexOf(';', i))); // eslint-disable-line no-eval
+  for (const p of ['/builders/people', '/builders/people/', '/builders/people.html',
+    '/builders/scouting', '/builders/scouting/', '/builders/scouting.html']) {
     assert.ok(rx.test(p), p + ' must reach the redirect');
   }
-  for (const p of ['/api/gds/scouting', '/api/bongos/scouting', '/builders/people',
-    '/builders/scoutingfoo', '/builders/scouting/extra']) {
-    assert.ok(!rx.test(p), p + ' must NOT be redirected — the data route and the directory are not the door');
+  for (const p of ['/api/gds/scouting', '/api/bongos/scouting', '/builders/roster',
+    '/builders/peoplefoo', '/builders/people/extra', '/builders/scoutingfoo', '/builders/scouting/extra']) {
+    assert.ok(!rx.test(p), p + ' must NOT be redirected — the data route and the roster are not the door');
   }
   // The gate is the half that would rot silently: a page-gate branch still
   // naming a deleted page is a wall guarding nothing.
-  assert.ok(!decomment(serve).includes('SCOUTING_PAGE_RE'),
-    'no page gate is left dispatching to a page that no longer exists');
-});
-
-test('the directory page loads its own script, sheet and toolkit', () => {
-  const people = read('people.html');
-  for (const html of [people]) {
-    assert.match(html, /\/builders\/people\.js/);
-    assert.match(html, /\/builders\/people\.css/);
-    assert.match(html, /\/builders\/dom-utils\.js/, 'the toolkit the rank label and the number formats come from');
-    assert.match(html, /<h1 class="page-head__h">People<\/h1>/);
+  const code = decomment(serve);
+  for (const gone of ['SCOUTING_PAGE_RE', 'PEOPLE_PAGE_RE', 'SCOUTING_LEGACY_RE', 'requireProjectCuratePage']) {
+    assert.ok(!code.includes(gone), `${gone} is gone — no gate dispatches to a page that no longer exists`);
   }
 });
 
-test('the directory row shows the avatar, the name and the login the API returns, and the name is a door', () => {
-  const src = read('people.js');
-  assert.match(src, /b\.avatar_url\s*\?\s*'<img class="dir-avatar" src="' \+ esc\(b\.avatar_url\)/, 'the avatar the pages dropped');
-  assert.match(src, /dir-avatar dir-avatar--initial/, 'an initial when there is none');
-  assert.match(src, /return b\.display_name \|\| b\.github_login \|\| \('#' \+ b\.github_id\);/, 'the display name reads first');
-  assert.match(src, /class="lb-name dir-name" href="https:\/\/github\.com\/' \+ encodeURIComponent\(b\.github_login\)/,
-    'the shell\'s .lb-name, to the one page every listed builder has');
-  assert.match(src, /'<span class="dir-login">@' \+ esc\(b\.github_login\)/, 'the login under the name says where the door goes');
-  // The chip is the assertion; what goes IN it is the role vocabulary, not the column
-  // (task 1004040). This line used to pin `esc(String(d))` — the raw value — so it read as
-  // a guard on the chip while actually holding the Directory to rendering 'unclassified'
-  // and a lowercase 'ui'. Pinning the wrapper and the helper keeps the original intent
-  // without pinning the defect that happened to be inside it.
-  assert.match(src, /<span class="fact-chip">' \+ esc\(roleLabel\(d\)\)/, 'roles are chips, spoken not printed');
-  assert.doesNotMatch(src, /class="num"/, 'the shell\'s ledger__num, not the bare .num scouting.js had corrected');
-  assert.match(src, /class="ledger__num"/);
-});
-
-test('the directory has a search, a sort and a craft lens on the kit bar, and pages through the kit', () => {
-  const src = read('people.js');
-  assert.match(src, /kit\.makeFilterBar\(\{/);
-  assert.match(src, /search: \{ id: 'people-q'/);
-  assert.match(src, /\{ id: 'people-sort', label: 'Sort'/);
-  // task 1003936: the axis label is read from OTB.roleAxisLabel(), never typed.
-  assert.match(src, /\{ id: 'people-craft', label: window\.OTB\.roleAxisLabel\(\)/);
-  assert.match(src, /kit\.makePager\('people'/);
-  assert.match(src, /kit\.makeLedger\(\{/);
-  assert.doesNotMatch(src, /createElement\('table'\)/, 'no hand-built table');
-});
-
-test('the directory names its floor from the pack, and never says Archon-only', () => {
-  const src = read('people.js');
-  assert.match(src, /rankLabel\('metic'\)/);
-  assert.doesNotMatch(decomment(src), /Archon-only/);
-  assert.doesNotMatch(read('people.html'), /Archon/);
+test('no hall page links to /people or loads its assets', () => {
+  const offenders = [];
+  for (const f of fs.readdirSync(PUB).filter((n) => /\.(html|js|css)$/.test(n))) {
+    const src = decomment(read(f)).replace(/<!--[\s\S]*?-->/g, '');
+    if (/['"(=]\/(builders\/)?people(\.html)?\/?['"?#)\s>]/.test(src)) offenders.push(`${f}: a /people link`);
+    if (/people\.(css|js)\b/.test(src)) offenders.push(`${f}: a people.css/people.js reference`);
+  }
+  assert.deepEqual(offenders, [], 'a link to the deleted page would bounce off the redirect for no reason');
+  // The roster's identity cell moved with it: the sheet is the roster's own now.
+  const roster = read('roster.html');
+  assert.match(roster, /\/builders\/roster\.css/, 'roster.html loads its own sheet');
+  assert.doesNotMatch(roster, /cross-project directory/, 'and no longer contrasts itself with a page the hall no longer has');
 });
 
 // =========================================================================
@@ -304,7 +276,7 @@ test('sessions: the floor is written from the pack\'s rank label, never a hardco
 // The harness carries what the pages read, and the states files ask for the new states
 // =========================================================================
 
-test('the harness feeds: rollups for every goal, the category set, avatars on the directory', () => {
+test('the harness feeds: rollups for every goal and the category set', () => {
   const goals = readJson('goals.json').goals;
   const rollups = readJson('goals__rollups.json').rollups;
   const byGoal = new Set(rollups.map((r) => String(r.goal_id)));
@@ -315,16 +287,13 @@ test('the harness feeds: rollups for every goal, the category set, avatars on th
   assert.ok(goals.some((g) => g.category && g.category.slug), 'some goals carry a category');
   const cats = readJson('work-categories.json').categories;
   assert.ok(cats.length >= 2 && cats.every((c) => c.slug && c.label));
-  const dir = readJson('scouting.json').builders;
-  assert.ok(dir.some((b) => b.avatar_url) && dir.some((b) => !b.avatar_url), 'the directory fixture has builders with and without an avatar');
+  assert.ok(!fs.existsSync(path.join(FIX, 'scouting.json')), 'the directory fixture left with the only page that read it');
 });
 
 test('the states files exercise the redesign\'s new states', () => {
   const goals = JSON.parse(read('goals.states.json'));
   assert.ok(goals.states.filters && goals.states.cards, 'goals: the Filters disclosure and the cards view are measured');
   assert.deepEqual(goals.states.cards.expect.value, [['#f-goal-view', 'cards']]);
-  const people = JSON.parse(read('people.states.json'));
-  assert.ok(people.states.search, 'people: a search is measured');
   const sessions = JSON.parse(read('sessions.states.json'));
   assert.deepEqual(sessions.states.ledger.expect.visible, ['#stats-scroll', '#sessions-scroll']);
 });

package/tests/module_contributions.mjs

@@ -227,7 +227,6 @@ test('the role axis has exactly one user-facing word, and no surface types it',
   const SURFACES = [
     'modules/hall-ui/public/work.js',
     'modules/hall-ui/public/goals-page.js',
-    'modules/hall-ui/public/people.js',
     'modules/hall-ui/public/profile.js',
     'modules/hall-ui/public/builders.js',
   ];

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'ff2017aa9bbbc507';
+const SHELL_SHA = '6b28297270d1e1f0';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);