@bongos/core 1.19.1060 → 1.19.1062

package/modules/copy-desk/tests/copy_docx.mjs

@@ -0,0 +1,347 @@
+// modules/copy-desk/tests/copy_docx.mjs — the Word round trip, pure (task
+// 1004320 / BV2.TW09, ADR 0341 D12).
+//
+// What docx.js must do before any route is involved: write a file Word can
+// open with one tagged paragraph per line; read an upload the way Word stores
+// an edit (runs split across <w:r> elements, proofing marks, smart quotes,
+// tracked changes, a data-descriptor zip); map it back by tag or by position;
+// merge it into a draft without losing a rewrite made after the download; and
+// refuse by name every change of structure. And bound every read of an
+// upload, which is someone else's input.
+//
+// The whole path (the routes, the holder check, the draft block on the task)
+// is tests/copy_desk_page_docx.mjs (root).
+
+import { strict as assert } from 'node:assert';
+import zlib from 'node:zlib';
+import { createRequire } from 'node:module';
+import { unzipAll, wordZip, resave, typeInto, wordRuns, trackedInsert, trackedDelete, stripControls, lineParagraph } from './fixtures/word-docx.mjs';
+
+const require = createRequire(import.meta.url);
+const docx = require('../docx.js');
+const pages = require('../pages.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const L = (key, section, text, placement, row) => ({ key, section, text, placement, ...(row || {}) });
+const READING = {
+  id: 'builders:studio',
+  title: 'Studio',
+  reading_hash: 'h-now',
+  lines: [
+    L('L0001', 'top bar', 'Studio', 'shared', { file: 'shell.js', line: 40, string_id: 'sh01' }),
+    L('L0002', 'greeting', 'Welcome back', 'placed', { file: 'studio.html', line: 12, string_id: 'st02' }),
+    L('L0003', 'greeting', '{…} pages tweaked', 'placed', { file: 'studio.js', line: 88, string_id: 'st03' }),
+    L('L0004', 'greeting', 'Your desk is quiet today', 'unplaced'),
+    L('L0005', 'greeting', 'It\u2019s your turn', 'placed', { file: 'studio.js', line: 90, string_id: 'st05' }),
+    L('L0006', 'footer', 'Resume', 'placed', { file: 'studio.html', line: 99, string_id: 'st06' }),
+    // A section that recurs later on the page gets its heading again.
+    L('L0007', 'greeting', 'Take the next page', 'placed', { file: 'studio.html', line: 120, string_id: 'st07' }),
+  ],
+};
+const download = (draft = null) => docx.composeDownload({ readingPage: READING, title: 'Studio', draft });
+const upload = (buf) => {
+  const u = docx.readUpload(buf);
+  assert.equal(u.ok, true, JSON.stringify(u));
+  return u;
+};
+const roundTrip = (buf, draft = null) => {
+  const u = upload(buf);
+  const m = docx.mapUpload({ readingPage: READING, upload: u });
+  if (!m.ok) return { mapped: m };
+  return { mapped: m, merged: docx.mergeUpload({ readingPage: READING, texts: m.texts, baseline: u.baseline, draft }) };
+};
+const draftOf = (lines) => ({ page_id: READING.id, reading_hash: READING.reading_hash, saved_at: 't', lines });
+
+console.log('copy-desk: the Word round trip');
+
+// ---------------------------------------------------------------------------
+// The zip, both directions, and the bounds on an upload.
+// ---------------------------------------------------------------------------
+
+test('the zip writer and reader agree, and the reader takes a Word-shaped zip (data descriptors)', () => {
+  const entries = [{ name: 'a.xml', data: '<a>é…</a>' }, { name: 'dir/b.xml', data: 'x'.repeat(5000) }];
+  const z = docx.readZip(docx.writeZip(entries));
+  assert.equal(z.ok, true);
+  assert.deepEqual([...z.parts].map(([k, v]) => [k, v.toString('utf8')]), entries.map((e) => [e.name, e.data]));
+  const w = docx.readZip(wordZip([['one.xml', '<one/>'], ['two.xml', 'two'.repeat(99)]]));
+  assert.equal(w.ok, true, JSON.stringify(w));
+  assert.equal(w.parts.get('two.xml').toString(), 'two'.repeat(99));
+  assert.equal(docx.crc32(Buffer.from('123456789')), 0xCBF43926, 'the standard CRC-32 check value');
+});
+
+test('the same page makes the same bytes', () => {
+  assert.equal(Buffer.compare(download(), download()), 0);
+});
+
+test('an upload that is not a zip, or a broken one, is not_a_docx', () => {
+  for (const bad of [Buffer.from('{"lines":[]}'), Buffer.from('PK\u0003\u0004 not really'), Buffer.alloc(0)]) {
+    assert.equal(docx.readUpload(bad).code, 'not_a_docx', bad.toString());
+  }
+  // A flipped byte inside the document part's deflated data fails its CRC (or
+  // its inflate). The first match is the local header's copy of the name.
+  const buf = Buffer.from(download());
+  const at = buf.indexOf('word/document.xml') + 'word/document.xml'.length + 40;
+  buf[at] ^= 0xFF;
+  assert.equal(docx.readUpload(buf).code, 'not_a_docx');
+  // A zip that is not a Word document.
+  assert.equal(docx.readUpload(docx.writeZip([{ name: 'hello.txt', data: 'hi' }])).detail.reason, 'the file has no Word document part');
+});
+
+test('an encrypted entry is refused, never guessed at', () => {
+  const buf = Buffer.from(download());
+  // Set the encryption flag on every central directory entry.
+  for (let i = 0; i < buf.length - 4; i++) if (buf.readUInt32LE(i) === 0x02014b50) buf.writeUInt16LE(buf.readUInt16LE(i + 8) | 1, i + 8);
+  const r = docx.readUpload(buf);
+  assert.equal(r.code, 'not_a_docx');
+  assert.match(r.detail.reason, /encrypted/);
+});
+
+test('a zip bomb stops at the part cap, and an oversized file is refused before it is read', () => {
+  // 9 MB of zeros deflates to a few kilobytes: the declared size is refused,
+  // and a lying declared size is stopped by the inflate cap itself.
+  const zeros = Buffer.alloc(docx.MAX_PART_BYTES + 1024 * 1024);
+  const honest = docx.writeZip([{ name: 'word/document.xml', data: zeros }]);
+  assert.ok(honest.length < 100 * 1024);
+  assert.equal(docx.readUpload(honest).code, 'upload_too_large');
+  const liar = Buffer.from(honest);
+  for (let i = 0; i < liar.length - 4; i++) if (liar.readUInt32LE(i) === 0x02014b50) liar.writeUInt32LE(10, i + 24);
+  assert.equal(docx.readZip(liar).code, 'upload_too_large');
+  assert.equal(docx.readUpload(Buffer.alloc(docx.MAX_UPLOAD_BYTES + 1, 1)).code, 'upload_too_large');
+});
+
+test('a DOCTYPE (an entity expansion) is refused, and entities are not expanded', () => {
+  const doctype = resave(download(), { document: (xml) => xml.replace('<w:document', '<!DOCTYPE d [<!ENTITY x "boom">]><w:document') });
+  assert.equal(docx.readUpload(doctype).code, 'not_a_docx');
+  assert.equal(docx.parseXml('<a>&amp;lt; &#x2019; &unknown;</a>').children[0], '&lt; \u2019 &unknown;');
+});
+
+// ---------------------------------------------------------------------------
+// The download.
+// ---------------------------------------------------------------------------
+
+test('the download: title, a Heading 2 per run of a section, one tagged plain-text control per line', () => {
+  const doc = unzipAll(download()).get('word/document.xml');
+  const paras = [...doc.matchAll(/<w:p>(.*?)<\/w:p>/gs)].map((m) => m[1]);
+  const style = (p) => (/<w:pStyle w:val="([^"]+)"/.exec(p) || [])[1] || null;
+  const text = (p) => [...p.matchAll(/<w:t[^>]*>([^<]*)<\/w:t>/g)].map((m) => m[1]).join('');
+  assert.deepEqual([style(paras[0]), text(paras[0])], ['Title', 'Studio']);
+  assert.equal(style(paras[1]), 'TweakNote');
+  const headings = paras.filter((p) => style(p) === 'Heading2').map(text);
+  assert.deepEqual(headings, ['top bar', 'greeting', 'footer', 'greeting']);
+  const lines = paras.filter((p) => /<w:tag /.test(p));
+  assert.deepEqual(lines.map((p) => /<w:tag w:val="([^"]+)"/.exec(p)[1]), READING.lines.map((l) => l.key));
+  for (const p of lines) assert.match(p, /<w:sdtPr><w:tag w:val="L\d{4}"\/><w:id w:val="\d+"\/><w:text\/><\/w:sdtPr>/, 'a plain-text control');
+  assert.equal(text(lines[4]), 'It\u2019s your turn');
+});
+
+test('shared and unplaced lines carry their own style and a margin comment', () => {
+  const parts = unzipAll(download());
+  const doc = parts.get('word/document.xml');
+  assert.match(lineParagraph(doc, 'L0001'), /<w:pStyle w:val="TweakShared"\/>.*<w:commentReference w:id="0"\/>/s);
+  assert.match(lineParagraph(doc, 'L0004'), /<w:pStyle w:val="TweakUnplaced"\/>.*<w:commentReference w:id="1"\/>/s);
+  assert.doesNotMatch(lineParagraph(doc, 'L0002'), /pStyle|comment/);
+  const comments = [...parts.get('word/comments.xml').matchAll(/<w:comment w:id="(\d)".*?<w:t[^>]*>([^<]*)<\/w:t>/gs)].map((m) => [m[1], m[2]]);
+  assert.deepEqual(comments, [['0', 'changes this on every page'], ['1', 'goes to an engineer']]);
+  assert.match(parts.get('word/styles.xml'), /w:styleId="TweakShared"/);
+  assert.match(parts.get('word/styles.xml'), /w:styleId="Heading2"><w:name w:val="heading 2"\/>/, 'the built-in Heading 2, so Word lists it as one');
+});
+
+test('page_id and reading_hash are custom document properties', () => {
+  const u = upload(download());
+  assert.equal(u.page_id, 'builders:studio');
+  assert.equal(u.reading_hash, 'h-now');
+  assert.match(unzipAll(download()).get('docProps/custom.xml'), /name="page_id"><vt:lpwstr>builders:studio<\/vt:lpwstr>/);
+});
+
+test('the download shows the draft over the reading, and ignores a draft saved on another reading', () => {
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Welcome home', placement: 'placed' }]);
+  assert.equal(upload(download(draft)).baseline.get('L0002'), 'Welcome home');
+  assert.match(unzipAll(download(draft)).get('word/document.xml'), />Welcome home</);
+  const stale = { ...draft, reading_hash: 'h-old' };
+  assert.doesNotMatch(unzipAll(download(stale)).get('word/document.xml'), />Welcome home</);
+});
+
+test('an untouched round trip changes nothing on every line', () => {
+  const { mapped, merged } = roundTrip(download());
+  assert.equal(mapped.mode, 'tag');
+  assert.deepEqual(merged.from_file, []);
+  const resolved = pages.resolveDraft({ readingPage: READING, body: { reading_hash: 'h-now', lines: merged.lines }, savedAt: 't' });
+  assert.deepEqual(resolved.draft.lines, []);
+});
+
+// ---------------------------------------------------------------------------
+// Reading an edit the way Word stores it.
+// ---------------------------------------------------------------------------
+
+test('Word splits one edited line across many runs: the upload reads the whole sentence', () => {
+  const edited = resave(download(), { document: (xml) => typeInto(xml, 'L0002', wordRuns(['Wel', 'come ', 'ho', 'me, ', 'friend'])) });
+  const { merged } = roundTrip(edited);
+  assert.deepEqual(merged.from_file, ['L0002']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0002').after, 'Welcome home, friend');
+});
+
+test('smart quotes: folded back on a line the page writes with straight quotes, kept on one written curly', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(typeInto(xml, 'L0002', wordRuns(['Welcome back, it\u2019s \u201Cyour\u201D desk'])),
+      'L0005', wordRuns(['It\u2019s ', 'your go'])),
+  });
+  const { merged } = roundTrip(edited);
+  const after = (k) => merged.lines.find((l) => l.key === k).after;
+  assert.equal(after('L0002'), 'Welcome back, it\'s "your" desk');
+  assert.equal(after('L0005'), 'It\u2019s your go');
+  // An autocorrect alone (a quote retyped, nothing else) is not a change.
+  const retyped = resave(download(), { document: (xml) => typeInto(xml, 'L0005', wordRuns(['It\'s your turn'])) });
+  assert.deepEqual(roundTrip(retyped).merged.from_file, []);
+});
+
+test('tracked changes read as accepted: an insertion is text, a deletion is not', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(xml, 'L0006', `${wordRuns(['Resume '])}${trackedDelete('now')}${trackedInsert('where you left off')}`),
+  });
+  assert.equal(roundTrip(edited).merged.lines.find((l) => l.key === 'L0006').after, 'Resume where you left off');
+});
+
+test('a tab, a line break and a different namespace prefix still read as the words', () => {
+  const edited = resave(download(), {
+    document: (xml) => typeInto(xml, 'L0002', '<w:r><w:t>Welcome</w:t><w:tab/><w:t>in</w:t><w:br/><w:t>here</w:t></w:r>')
+      .replace(/xmlns:w=/, 'xmlns:ww=').replace(/<(\/?)w:/g, '<$1ww:').replace(/ w:/g, ' ww:'),
+  });
+  assert.equal(roundTrip(edited).merged.lines.find((l) => l.key === 'L0002').after, 'Welcome in here');
+});
+
+// ---------------------------------------------------------------------------
+// The merge.
+// ---------------------------------------------------------------------------
+
+test('the merge keeps a rewrite made in the studio after the download', () => {
+  const file = download(); // shows the page's own text everywhere
+  const edited = resave(file, { document: (xml) => typeInto(xml, 'L0006', wordRuns(['Pick up ', 'where you were'])) });
+  // Since the download, the artist rewrote L0002 in the studio.
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Hello again', placement: 'placed' }]);
+  const { merged } = roundTrip(edited, draft);
+  const after = (k) => merged.lines.find((l) => l.key === k).after;
+  assert.equal(after('L0002'), 'Hello again', 'the file did not touch L0002, so the draft keeps it');
+  assert.equal(after('L0006'), 'Pick up where you were');
+  assert.deepEqual(merged.from_file, ['L0006']);
+  assert.deepEqual(merged.kept_from_draft, ['L0002']);
+});
+
+test('a line changed in Word wins over the draft; without the file\'s baseline the file is the whole state', () => {
+  const draft = draftOf([{ key: 'L0002', section: 'greeting', before: 'Welcome back', after: 'Hello again', placement: 'placed' }]);
+  const edited = resave(download(), { document: (xml) => typeInto(xml, 'L0002', wordRuns(['Hi there'])) });
+  assert.equal(roundTrip(edited, draft).merged.lines.find((l) => l.key === 'L0002').after, 'Hi there');
+  // An editor that drops the custom XML part: every line is what the file says,
+  // so the studio rewrite of L0002 is replaced by the page text the file shows.
+  const noBaseline = resave(download(), { drop: ['customXml/item1.xml'] });
+  const u = upload(noBaseline);
+  assert.equal(u.baseline, null);
+  const { merged } = roundTrip(noBaseline, draft);
+  assert.equal(merged.lines.find((l) => l.key === 'L0002').after, 'Welcome back');
+  assert.deepEqual(merged.from_file, ['L0002']);
+});
+
+// ---------------------------------------------------------------------------
+// Structure changes are refused, by name.
+// ---------------------------------------------------------------------------
+
+const refusal = (buf) => {
+  const { mapped } = roundTrip(buf);
+  assert.equal(mapped.ok, false);
+  assert.equal(mapped.code, 'structure_changed');
+  return mapped.detail.moved;
+};
+
+test('an added paragraph is named by its section and first words', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, () => `${p}<w:p><w:r><w:t>A brand new line nobody asked for today</w:t></w:r></w:p>`); },
+  });
+  assert.deepEqual(refusal(buf), [{ change: 'added', key: null, section: 'greeting', first_words: 'A brand new line nobody asked…' }]);
+});
+
+test('a dropped line is named by its key, section and first words', () => {
+  const buf = resave(download(), { document: (xml) => xml.replace(lineParagraph(xml, 'L0004'), '') });
+  assert.deepEqual(refusal(buf), [{ change: 'dropped', key: 'L0004', section: 'greeting', first_words: 'Your desk is quiet today' }]);
+});
+
+test('a moved line is named, and only the line that moved', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, '').replace(lineParagraph(xml, 'L0004'), (q) => `${q}${p}`); },
+  });
+  assert.deepEqual(refusal(buf), [{ change: 'reordered', key: 'L0002', section: 'greeting', first_words: 'Welcome back' }]);
+});
+
+test('a copied control is an added line; two lines joined into one paragraph drop the second', () => {
+  const copied = resave(download(), { document: (xml) => { const p = lineParagraph(xml, 'L0006'); return xml.replace(p, () => `${p}${p}`); } });
+  assert.deepEqual(refusal(copied), [{ change: 'added', key: 'L0006', section: 'footer', first_words: 'Resume' }]);
+  const joined = resave(download(), {
+    document: (xml) => {
+      const a = lineParagraph(xml, 'L0002');
+      const b = lineParagraph(xml, 'L0003');
+      const sdtB = /<w:sdt>.*<\/w:sdt>/s.exec(b)[0];
+      return xml.replace(b, '').replace(a, () => a.replace('</w:p>', `${sdtB}</w:p>`));
+    },
+  });
+  assert.deepEqual(refusal(joined), [{ change: 'dropped', key: 'L0003', section: 'greeting', first_words: '{…} pages tweaked', joined_to: 'L0002' }]);
+});
+
+test('a changed section heading is refused', () => {
+  const buf = resave(download(), { document: (xml) => xml.replace('<w:t xml:space="preserve">footer</w:t>', '<w:t>Footer bits</w:t>') });
+  assert.deepEqual(refusal(buf), [{ change: 'heading_changed', expected: 'footer', found: 'Footer bits' }]);
+});
+
+test('empty paragraphs (spacing) and the title and note are not lines', () => {
+  const buf = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0002'); return xml.replace(p, () => `<w:p/>${p}<w:p><w:r><w:t> </w:t></w:r></w:p>`).replace('>Studio</w:t></w:r></w:p>', '>My studio notes</w:t></w:r></w:p>'); },
+  });
+  const { mapped } = roundTrip(buf);
+  assert.equal(mapped.ok, true, JSON.stringify(mapped.detail));
+});
+
+// ---------------------------------------------------------------------------
+// When every tag is gone: by position.
+// ---------------------------------------------------------------------------
+
+test('with the controls stripped, lines map by position under the same headings', () => {
+  const buf = resave(download(), { document: (xml) => stripControls(typeInto(xml, 'L0006', wordRuns(['Carry ', 'on']))) });
+  assert.doesNotMatch(unzipAll(buf).get('word/document.xml'), /<w:tag /);
+  const { mapped, merged } = roundTrip(buf);
+  assert.equal(mapped.mode, 'position');
+  assert.deepEqual(merged.from_file, ['L0006']);
+  assert.equal(merged.lines.find((l) => l.key === 'L0006').after, 'Carry on');
+});
+
+test('by position, a section with a line more or a line fewer is refused and named', () => {
+  const extra = resave(download(), {
+    document: (xml) => { const p = lineParagraph(xml, 'L0006'); return stripControls(xml.replace(p, () => `${p}<w:p><w:r><w:t>Another line</w:t></w:r></w:p>`)); },
+  });
+  assert.deepEqual(refusal(extra), [{ change: 'added', key: null, section: 'footer', first_words: 'Another line' }]);
+  const fewer = resave(download(), { document: (xml) => stripControls(xml.replace(lineParagraph(xml, 'L0006'), '')) });
+  assert.deepEqual(refusal(fewer), [{ change: 'dropped', key: 'L0006', section: 'footer', first_words: 'Resume' }]);
+  const heading = resave(download(), { document: (xml) => stripControls(xml.replace('<w:t xml:space="preserve">top bar</w:t>', '<w:t>Top</w:t>')) });
+  assert.equal(refusal(heading)[0].change, 'heading_changed');
+});
+
+// ---------------------------------------------------------------------------
+// Every page the inventory reads round-trips untouched.
+// ---------------------------------------------------------------------------
+
+test('every committed page reading round-trips with no change', () => {
+  const readings = require('../../../docs/page-readings.json');
+  for (const p of readings.pages) {
+    const u = docx.readUpload(docx.composeDownload({ readingPage: p, title: p.title, draft: null }));
+    assert.equal(u.ok, true, p.id);
+    const m = docx.mapUpload({ readingPage: p, upload: u });
+    assert.equal(m.ok, true, `${p.id}: ${JSON.stringify(m.detail)}`);
+    assert.deepEqual(docx.mergeUpload({ readingPage: p, texts: m.texts, baseline: u.baseline, draft: null }).from_file, [], p.id);
+  }
+  assert.ok(zlib, 'node:zlib is the only dependency');
+});
+
+console.log(`\ncopy_docx: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -21,7 +21,9 @@
 // which no renderer reads — and the wording reaches a person only after somebody
 // claims that task and ships the diff. So the four things pinned here are:
 //
-//   * the write surface is EXACTLY the three verbs the module defines,
+//   * the write surface is EXACTLY the verbs the module defines (eight since
+//     TW09: the page draft, its Word upload and the submit write the round
+//     TASK, never a row),
 //   * no column on copy_desk_flags could hold replacement text,
 //   * nothing in this module writes a file, and
 //   * the ONLY thing that writes a surface file is the applier, it lives outside
@@ -63,7 +65,8 @@ const stripComments = (src) => src
 // reads: pages.js (the page-tweak block format), page-status.js (the derived
 // status, drift and tally) and page-data.js (the read side of the page
 // inventory and readings). They are held to the same two rules as the rest.
-const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'routes/copy-desk.js'];
+// TW09 (task 1004320) added docx.js, the Word round trip over Buffers.
+const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'docx.js', 'routes/copy-desk.js'];
 
 console.log('copy-desk: NO LIVE CMS');
 
@@ -80,7 +83,17 @@ await test('the write surface is exactly the verbs the module defines', () => {
     // flag row whose target is a page id. Neither stores wording.
     'POST /copy-desk/pages/:pageId/asks',
     'POST /copy-desk/pages/:pageId/claim',
+    // TW09 (task 1004320, ADR 0341 D11, D12): the Word upload. It lands in the
+    // round's DRAFT through the autosave's own port call and resolver, never a
+    // row here, a file, or the site.
+    'POST /copy-desk/pages/:pageId/draft.docx',
+    // TW08 (task 1004319, ADR 0341 D4, D11): the draft autosave and the
+    // submit. Both write the page round's TASK DESCRIPTION through the
+    // lifecycle port, the place ADR 0233 lets wording rest; neither writes a
+    // row here, a file, or anything a renderer reads.
+    'POST /copy-desk/pages/:pageId/submit',
     'POST /copy-desk/proposals',
+    'PUT /copy-desk/pages/:pageId/draft',
   ], 'a new write route on this module must be a deliberate, reviewed change to this list');
 });
 
@@ -185,6 +198,57 @@ await test('the page claim creates a TASK through the port and writes no row her
   assert.ok(/roundTaskBody\(page, n\)/.test(claim), 'the round body comes from pages.roundTaskBody over the inventory page');
 });
 
+await test('the draft and the submit write only the round task, through the port, with targets from the reading', () => {
+  const src = stripComments(read('routes/copy-desk.js'));
+  const handler = (verb, p) => {
+    const start = src.indexOf(`router.${verb}('${p}'`);
+    assert.ok(start >= 0, `${verb.toUpperCase()} ${p} is mounted`);
+    const next = src.indexOf('router.', start + 1);
+    return src.slice(start, next === -1 ? undefined : next);
+  };
+  const draft = handler('put', '/copy-desk/pages/:pageId/draft');
+  const submit = handler('post', '/copy-desk/pages/:pageId/submit');
+  assert.ok(/lifecycle\.updateHeldTaskDescription\(/.test(draft), 'the draft lands on the task via the lifecycle port');
+  assert.ok(/lifecycle\.submitPageTweak\(/.test(submit), 'the submit lands on the task via the lifecycle port');
+  for (const [name, h] of [['draft', draft], ['submit', submit]]) {
+    assert.equal(/insertFlag|closeFlag|INSERT INTO|UPDATE /i.test(h), false, `the ${name} route must write no row in this module`);
+    // Every target fact is the reading's. A handler reading `before`, a
+    // section, a placement or a file from the body would let a caller describe
+    // an edit to a sentence the page does not show.
+    assert.equal(/req\.body\.(before|section|placement|file|line|string_id|text)\b/.test(h), false,
+      `the ${name} route must not take a target from the request body`);
+    assert.ok(/readingPageOrFail\(res, pageId\)/.test(h), `the ${name} route resolves against the page reading`);
+  }
+  assert.ok(/pages\.resolveDraft\(\{ readingPage,/.test(draft), 'the draft is resolved from the reading by pages.resolveDraft');
+  assert.ok(/pages\.freezeBatch\(\{ readingPage,/.test(submit), 'the batch is frozen from the reading by pages.freezeBatch');
+  // The body schemas carry no target field.
+  const schemas = src.slice(src.indexOf('const DRAFT_BODY_SCHEMA'), src.indexOf('const PAGE_REFUSAL_STATUS'));
+  assert.equal(/\b(before|section|placement|file|string_id)\s*:/.test(schemas), false, 'the draft and submit schemas name no target field');
+});
+
+await test('the Word round trip is pure over Buffers, and its upload writes only the draft, through the port', () => {
+  // docx.js handles an artist's wording like pages.js does, so it is held to
+  // the same shape: its one require is node:zlib (a zip is deflate), and it
+  // reaches no fs, pool or network.
+  const lib = stripComments(read('docx.js'));
+  assert.deepEqual([...lib.matchAll(/require\(\s*'([^']+)'\s*\)/g)].map((m) => m[1]), ['node:zlib'],
+    'docx.js may require node:zlib and nothing else');
+  for (const forbidden of ['fs.', 'pool', 'fetch(']) {
+    assert.equal(lib.includes(forbidden), false, `docx.js must stay pure — it must not reach for ${forbidden}`);
+  }
+  const src = stripComments(read('routes/copy-desk.js'));
+  const start = src.indexOf("router.post('/copy-desk/pages/:pageId/draft.docx'");
+  assert.ok(start >= 0, 'the upload is mounted');
+  const next = src.indexOf('router.', start + 1);
+  const h = src.slice(start, next === -1 ? undefined : next);
+  assert.ok(/lifecycle\.updateHeldTaskDescription\(/.test(h), 'the upload lands on the task via the autosave\'s port call (holder only)');
+  assert.ok(/pages\.resolveDraft\(\{ readingPage,/.test(h), 'the upload is resolved from the reading by the autosave\'s resolver');
+  assert.ok(/pages\.saveDraftInto\(/.test(h), 'the upload writes the draft block through the autosave\'s writer');
+  assert.ok(/readingPageOrFail\(res, pageId\)/.test(h), 'the upload resolves against the page reading');
+  assert.equal(/insertFlag|closeFlag|INSERT INTO|UPDATE |composeBatchBlock|submitPageTweak/i.test(h), false,
+    'the upload writes the draft and nothing else: no row, and never the frozen batch');
+});
+
 await test('the module manifest declares no seam another module could write copy through', () => {
   const manifest = JSON.parse(read('module.json'));
   assert.deepEqual(manifest.provides, [], 'a provided port here would be a copy write path for every other module');

package/modules/copy-desk/tests/copy_page_draft.mjs

@@ -0,0 +1,202 @@
+// modules/copy-desk/tests/copy_page_draft.mjs — the page draft and the frozen
+// batch, pure (task 1004319 / BV2.TW08, ADR 0341 D4).
+//
+// What the resolvers in pages.js must do before any route or transaction is
+// involved: a draft save resolves every target from the page reading and keeps
+// only changed lines; the same draft again is recognised as the same; the
+// submit re-resolves each line on the CURRENT reading, refuses by name the
+// lines it cannot place, and splits the unplaced rewrites out for an engineer.
+//
+// The whole path (routes, the lifecycle transaction, the engineer tasks, the
+// released claim) is tests/copy_desk_page_submit.mjs (root).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const pages = require('../pages.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+// A page reading in the shape page-reader.js writes: placed lines carry their
+// registry row, a shared line may or may not have one, an unplaced line none.
+const L = (key, section, text, placement, row) => ({ key, section, text, placement, ...(row || {}) });
+const READING = {
+  id: 'landing:index',
+  reading_hash: 'h-now',
+  lines: [
+    L('L0001', 'skip link', 'Skip to content', 'shared', { file: 'shell.js', line: 7, string_id: 'aaa111' }),
+    L('L0002', 'top bar', 'Ctrl K', 'shared'),
+    L('L0003', 'hero', 'Build here', 'placed', { file: 'index.html', line: 12, string_id: 'bbb222' }),
+    L('L0004', 'hero', '{…} of {…} shipped', 'placed', { file: 'index.js', line: 40, string_id: 'ccc333' }),
+    L('L0005', 'hero', 'Cloud Bongos: Building Digitally', 'unplaced'),
+    L('L0006', 'footer', 'Resume', 'placed', { file: 'index.html', line: 90, string_id: 'ddd444' }),
+  ],
+};
+const SAVED_AT = '2026-09-28T10:00:00.000Z';
+const body = (lines, hash = 'h-now') => ({ reading_hash: hash, lines });
+
+console.log('copy-desk: the page draft and the frozen batch');
+
+test('a draft resolves every target from the reading and keeps only changed lines, in page order', () => {
+  const r = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([
+    { key: 'L0006', after: 'Pick up where you left off' },
+    { key: 'L0003', after: '  Build   it here ' },
+    { key: 'L0001', after: 'Skip to content' }, // unchanged: dropped
+  ]) });
+  assert.equal(r.ok, true, JSON.stringify(r));
+  assert.deepEqual(r.draft, {
+    page_id: 'landing:index', reading_hash: 'h-now', saved_at: SAVED_AT,
+    lines: [
+      { key: 'L0003', section: 'hero', before: 'Build here', after: 'Build it here', placement: 'placed' },
+      { key: 'L0006', section: 'footer', before: 'Resume', after: 'Pick up where you left off', placement: 'placed' },
+    ],
+  });
+});
+
+test('a draft body cannot describe its own target: before, section and placement are ignored', () => {
+  const r = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([
+    { key: 'L0003', after: 'New words', before: 'A sentence the page does not show', section: 'x', placement: 'unplaced' },
+  ]) });
+  assert.equal(r.ok, true);
+  assert.deepEqual([r.draft.lines[0].before, r.draft.lines[0].section, r.draft.lines[0].placement], ['Build here', 'hero', 'placed']);
+});
+
+test('a draft built on another reading is refused whole, reading_moved, naming the current hash', () => {
+  const r = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([{ key: 'L0003', after: 'x y' }], 'h-old') });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'reading_moved');
+  assert.deepEqual(r.detail, { reading_hash: 'h-now', sent: 'h-old' });
+});
+
+test('the draft refusals are named: unknown line, empty line, too long, duplicate, malformed, no reading', () => {
+  const code = (lines) => pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body(lines) }).code;
+  assert.equal(code([{ key: 'L0099', after: 'x' }]), 'unknown_line');
+  assert.equal(code([{ key: 'L0003', after: '   ' }]), 'line_empty');
+  assert.equal(code([{ key: 'L0003', after: 'x'.repeat(pages.MAX_LINE_CHARS + 1) }]), 'line_too_long');
+  assert.equal(code([{ key: 'L0003', after: 'a' }, { key: 'L0003', after: 'b' }]), 'duplicate_line');
+  assert.equal(code([{ key: 'nope', after: 'a' }]), 'line_malformed');
+  assert.equal(code([{ key: 'L0003' }]), 'line_malformed');
+  assert.equal(pages.resolveDraft({ readingPage: null, body: body([]) }).code, 'reading_missing');
+});
+
+test('an autosave mid-sentence is accepted: the placeholder arithmetic waits for the submit', () => {
+  const r = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([{ key: 'L0004', after: 'shipped so far' }]) });
+  assert.equal(r.ok, true);
+});
+
+test('sameDraft ignores saved_at, so an unchanged autosave is recognised', () => {
+  const a = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([{ key: 'L0003', after: 'Build it here' }]) }).draft;
+  const b = pages.resolveDraft({ readingPage: READING, savedAt: '2026-09-28T11:00:00.000Z', body: body([{ key: 'L0003', after: 'Build it here' }]) }).draft;
+  const c = pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body([{ key: 'L0003', after: 'Build it there' }]) }).draft;
+  assert.equal(pages.sameDraft(a, b), true);
+  assert.equal(pages.sameDraft(a, c), false);
+  // Round-trips through the block: what is stored is what is compared.
+  const parsed = pages.parseDraftBlock(pages.composeDraftBlock(a));
+  assert.equal(parsed.ok, true);
+  assert.equal(pages.sameDraft(parsed.draft, b), true);
+});
+
+test('replaceBlock replaces the one draft in place, appends when there is none, refuses two', () => {
+  const intro = 'Page tweak round 1.';
+  const d1 = pages.composeDraftBlock({ page_id: 'landing:index', reading_hash: 'h', saved_at: 'a', lines: [] });
+  const d2 = pages.composeDraftBlock({ page_id: 'landing:index', reading_hash: 'h', saved_at: 'b', lines: [] });
+  const first = pages.replaceBlock(intro, pages.FENCES.draft, d1);
+  assert.equal(first.description, `${intro}\n\n${d1}`);
+  const second = pages.replaceBlock(first.description, pages.FENCES.draft, d2);
+  assert.equal(second.description, `${intro}\n\n${d2}`);
+  // The batch fence is a prefix of the draft fence: replacing the batch must
+  // not touch the draft.
+  const batch = pages.composeBatchBlock({ page_id: 'landing:index', reading_hash: 'h', submitted_at: 's', lines: [] });
+  const both = pages.replaceBlock(second.description, pages.FENCES.batch, batch).description;
+  assert.ok(both.includes(d2) && both.includes(batch));
+  assert.equal(pages.parseDraftBlock(both).ok, true);
+  assert.equal(pages.parseBatchBlock(both).ok, true);
+  assert.equal(pages.replaceBlock(`${d1}\n\n${d2}`, pages.FENCES.draft, d1).code, 'multiple_blocks');
+});
+
+const draftOf = (lines) => pages.resolveDraft({ readingPage: READING, savedAt: SAVED_AT, body: body(lines) }).draft;
+
+test('the submit freezes placed and shared lines with their registry rows, and splits the unplaced out', () => {
+  const draft = draftOf([
+    { key: 'L0001', after: 'Jump to the page' },
+    { key: 'L0002', after: 'Control K' },
+    { key: 'L0003', after: 'Build it here' },
+    { key: 'L0005', after: 'Cloud Bongos: build it with us' },
+  ]);
+  const f = pages.freezeBatch({ readingPage: READING, draft, submittedAt: 'S' });
+  assert.equal(f.ok, true, JSON.stringify(f));
+  assert.deepEqual(f.batch.lines.map((l) => [l.key, l.placement, l.file, l.line, l.string_id, l.after]), [
+    ['L0001', 'shared', 'shell.js', 7, 'aaa111', 'Jump to the page'],
+    ['L0003', 'placed', 'index.html', 12, 'bbb222', 'Build it here'],
+  ]);
+  // Unplaced text, and shared shell text the registry has no row for, go to an engineer.
+  assert.deepEqual(f.unplaced.map((l) => [l.key, l.placement, l.before, l.after]), [
+    ['L0002', 'shared', 'Ctrl K', 'Control K'],
+    ['L0005', 'unplaced', 'Cloud Bongos: Building Digitally', 'Cloud Bongos: build it with us'],
+  ]);
+  assert.equal(f.batch.reading_hash, 'h-now');
+  assert.equal(f.batch.submitted_at, 'S');
+});
+
+test('a line the page no longer shows is refused target_gone, by name, and nothing is frozen', () => {
+  const draft = draftOf([{ key: 'L0003', after: 'Build it here' }, { key: 'L0006', after: 'Carry on' }]);
+  const moved = { ...READING, reading_hash: 'h-next', lines: READING.lines.filter((l) => l.key !== 'L0003') };
+  const f = pages.freezeBatch({ readingPage: moved, draft, submittedAt: 'S' });
+  assert.equal(f.ok, false);
+  assert.equal(f.code, 'lines_refused');
+  assert.deepEqual(f.detail.refused, [{ key: 'L0003', section: 'hero', before: 'Build here', code: 'target_gone' }]);
+});
+
+test('a line that moved to another key is found by its words, and frozen under its new key', () => {
+  const draft = draftOf([{ key: 'L0006', after: 'Carry on' }]);
+  const shifted = { ...READING, reading_hash: 'h-next', lines: [
+    L('L0001', 'skip link', 'Skip to content', 'shared', { file: 'shell.js', line: 7, string_id: 'aaa111' }),
+    L('L0002', 'hero', 'A new line above', 'placed', { file: 'index.html', line: 5, string_id: 'eee555' }),
+    L('L0007', 'footer', 'Resume', 'placed', { file: 'index.html', line: 91, string_id: 'ddd444' }),
+  ] };
+  const f = pages.freezeBatch({ readingPage: shifted, draft, submittedAt: 'S' });
+  assert.equal(f.ok, true, JSON.stringify(f));
+  assert.deepEqual([f.batch.lines[0].key, f.batch.lines[0].line, f.batch.reading_hash], ['L0007', 91, 'h-next']);
+});
+
+test('the same words in two places on a moved page are ambiguous_target, never a guess', () => {
+  const draft = draftOf([{ key: 'L0006', after: 'Carry on' }]);
+  const twice = { ...READING, lines: [
+    L('L0001', 'a', 'Resume', 'placed', { file: 'x', line: 1, string_id: 's1' }),
+    L('L0002', 'b', 'Resume', 'placed', { file: 'x', line: 2, string_id: 's1' }),
+  ] };
+  const f = pages.freezeBatch({ readingPage: twice, draft, submittedAt: 'S' });
+  assert.deepEqual(f.detail.refused.map((x) => x.code), ['ambiguous_target']);
+});
+
+test('the placeholder arithmetic is checked per line at submit', () => {
+  const bad = pages.freezeBatch({ readingPage: READING, draft: draftOf([{ key: 'L0004', after: 'shipped so far' }]), submittedAt: 'S' });
+  assert.deepEqual(bad.detail.refused, [{ key: 'L0004', section: 'hero', before: '{…} of {…} shipped', code: 'placeholder_mismatch', expected: 2, got: 0 }]);
+  const moved = pages.freezeBatch({ readingPage: READING, draft: draftOf([{ key: 'L0004', after: '{…} shipped, of {…}' }]), submittedAt: 'S' });
+  assert.equal(moved.ok, true, 'a hole may MOVE within the sentence');
+});
+
+test('an empty draft is nothing_to_submit', () => {
+  assert.equal(pages.freezeBatch({ readingPage: READING, draft: draftOf([]), submittedAt: 'S' }).code, 'nothing_to_submit');
+  assert.equal(pages.freezeBatch({ readingPage: READING, draft: null, submittedAt: 'S' }).code, 'nothing_to_submit');
+});
+
+test('the engineer task carries the page, the line and the wording, keyed per round and line', () => {
+  const page = { id: 'landing:index', title: 'Home', path: '/' };
+  const line = { key: 'L0005', section: 'hero', before: 'Cloud Bongos: Building Digitally', after: 'Cloud Bongos: build it with us', placement: 'unplaced' };
+  assert.equal(pages.unplacedSourceRef('5001', 'L0005'), 'page-tweak-unplaced/5001/L0005');
+  assert.equal(pages.unplacedTaskTitle(page, line), 'Place and reword "Cloud Bongos: Building Digitally" (landing:index)');
+  const b = pages.unplacedTaskBody(page, line, '5001');
+  for (const want of ['landing:index', 'Home', 'L0005', 'hero', '"Cloud Bongos: Building Digitally"', '"Cloud Bongos: build it with us"', 'task 5001', 'does not wait']) {
+    assert.ok(b.includes(want), `the body names ${want}`);
+  }
+});
+
+console.log(`\ncopy_page_draft: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);