@bongos/core 1.19.1061 → 1.19.1062

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -21,8 +21,9 @@
 // which no renderer reads — and the wording reaches a person only after somebody
 // claims that task and ships the diff. So the four things pinned here are:
 //
-//   * the write surface is EXACTLY the verbs the module defines (seven since
-//     TW08: the page draft and submit write the round TASK, never a row),
+//   * the write surface is EXACTLY the verbs the module defines (eight since
+//     TW09: the page draft, its Word upload and the submit write the round
+//     TASK, never a row),
 //   * no column on copy_desk_flags could hold replacement text,
 //   * nothing in this module writes a file, and
 //   * the ONLY thing that writes a surface file is the applier, it lives outside
@@ -64,7 +65,8 @@ const stripComments = (src) => src
 // reads: pages.js (the page-tweak block format), page-status.js (the derived
 // status, drift and tally) and page-data.js (the read side of the page
 // inventory and readings). They are held to the same two rules as the rest.
-const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'routes/copy-desk.js'];
+// TW09 (task 1004320) added docx.js, the Word round trip over Buffers.
+const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'page-status.js', 'page-data.js', 'docx.js', 'routes/copy-desk.js'];
 
 console.log('copy-desk: NO LIVE CMS');
 
@@ -81,6 +83,10 @@ await test('the write surface is exactly the verbs the module defines', () => {
     // flag row whose target is a page id. Neither stores wording.
     'POST /copy-desk/pages/:pageId/asks',
     'POST /copy-desk/pages/:pageId/claim',
+    // TW09 (task 1004320, ADR 0341 D11, D12): the Word upload. It lands in the
+    // round's DRAFT through the autosave's own port call and resolver, never a
+    // row here, a file, or the site.
+    'POST /copy-desk/pages/:pageId/draft.docx',
     // TW08 (task 1004319, ADR 0341 D4, D11): the draft autosave and the
     // submit. Both write the page round's TASK DESCRIPTION through the
     // lifecycle port, the place ADR 0233 lets wording rest; neither writes a
@@ -220,6 +226,29 @@ await test('the draft and the submit write only the round task, through the port
   assert.equal(/\b(before|section|placement|file|string_id)\s*:/.test(schemas), false, 'the draft and submit schemas name no target field');
 });
 
+await test('the Word round trip is pure over Buffers, and its upload writes only the draft, through the port', () => {
+  // docx.js handles an artist's wording like pages.js does, so it is held to
+  // the same shape: its one require is node:zlib (a zip is deflate), and it
+  // reaches no fs, pool or network.
+  const lib = stripComments(read('docx.js'));
+  assert.deepEqual([...lib.matchAll(/require\(\s*'([^']+)'\s*\)/g)].map((m) => m[1]), ['node:zlib'],
+    'docx.js may require node:zlib and nothing else');
+  for (const forbidden of ['fs.', 'pool', 'fetch(']) {
+    assert.equal(lib.includes(forbidden), false, `docx.js must stay pure — it must not reach for ${forbidden}`);
+  }
+  const src = stripComments(read('routes/copy-desk.js'));
+  const start = src.indexOf("router.post('/copy-desk/pages/:pageId/draft.docx'");
+  assert.ok(start >= 0, 'the upload is mounted');
+  const next = src.indexOf('router.', start + 1);
+  const h = src.slice(start, next === -1 ? undefined : next);
+  assert.ok(/lifecycle\.updateHeldTaskDescription\(/.test(h), 'the upload lands on the task via the autosave\'s port call (holder only)');
+  assert.ok(/pages\.resolveDraft\(\{ readingPage,/.test(h), 'the upload is resolved from the reading by the autosave\'s resolver');
+  assert.ok(/pages\.saveDraftInto\(/.test(h), 'the upload writes the draft block through the autosave\'s writer');
+  assert.ok(/readingPageOrFail\(res, pageId\)/.test(h), 'the upload resolves against the page reading');
+  assert.equal(/insertFlag|closeFlag|INSERT INTO|UPDATE |composeBatchBlock|submitPageTweak/i.test(h), false,
+    'the upload writes the draft and nothing else: no row, and never the frozen batch');
+});
+
 await test('the module manifest declares no seam another module could write copy through', () => {
   const manifest = JSON.parse(read('module.json'));
   assert.deepEqual(manifest.provides, [], 'a provided port here would be a copy write path for every other module');

package/modules/copy-desk/tests/fixtures/word-docx.mjs

@@ -0,0 +1,131 @@
+// modules/copy-desk/tests/fixtures/word-docx.mjs — edit a downloaded page .docx
+// the way Word stores an edit (task 1004320 / BV2.TW09, ADR 0341 D12).
+//
+// The Word round-trip tests must not prove the reader against its own writer
+// only. So this fixture re-packs a file the way Word does, with its OWN zip
+// writer (data descriptors after each entry, zero sizes in the local headers,
+// entries in another order), and rewrites a line's paragraph the way Word
+// leaves one after typing: the text split across several runs with their own
+// properties and revision ids, proofing marks between them, smart quotes, and
+// tracked insertions and deletions.
+//
+// Shared by modules/copy-desk/tests/copy_docx.mjs and
+// tests/copy_desk_page_docx.mjs (a fixture, not a test: the runner discovers
+// tests/*.mjs only, not this folder).
+
+import zlib from 'node:zlib';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const docx = require('../../docx.js');
+
+// Every entry of a zip, by the module's own reader (reading is not what these
+// tests doubt; the re-pack below is independent of the module's writer).
+export function unzipAll(buf) {
+  const z = docx.readZip(buf);
+  if (!z.ok) throw new Error(`unzip: ${z.code} ${JSON.stringify(z.detail)}`);
+  return new Map([...z.parts].map(([k, v]) => [k, v.toString('utf8')]));
+}
+
+// Pack entries the way Word writes a .docx: general-purpose flag bit 3 (sizes
+// and CRC in a data descriptor after the data, zeros in the local header),
+// deflated, in the order given.
+export function wordZip(entries) {
+  const out = [];
+  const central = [];
+  let offset = 0;
+  for (const [name, text] of entries) {
+    const data = Buffer.from(text, 'utf8');
+    const packed = zlib.deflateRawSync(data, { level: 6 });
+    const crc = docx.crc32(data);
+    const nameBuf = Buffer.from(name, 'utf8');
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0x0008 | 0x0800, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(0x6000, 10);
+    local.writeUInt16LE(0x5b3c, 12);
+    local.writeUInt16LE(nameBuf.length, 26);
+    const desc = Buffer.alloc(16);
+    desc.writeUInt32LE(0x08074b50, 0);
+    desc.writeUInt32LE(crc, 4);
+    desc.writeUInt32LE(packed.length, 8);
+    desc.writeUInt32LE(data.length, 12);
+    const c = Buffer.alloc(46);
+    c.writeUInt32LE(0x02014b50, 0);
+    c.writeUInt16LE(45, 4);
+    c.writeUInt16LE(20, 6);
+    c.writeUInt16LE(0x0008 | 0x0800, 8);
+    c.writeUInt16LE(8, 10);
+    c.writeUInt16LE(0x6000, 12);
+    c.writeUInt16LE(0x5b3c, 14);
+    c.writeUInt32LE(crc, 16);
+    c.writeUInt32LE(packed.length, 20);
+    c.writeUInt32LE(data.length, 24);
+    c.writeUInt16LE(nameBuf.length, 28);
+    c.writeUInt32LE(offset, 42);
+    out.push(local, nameBuf, packed, desc);
+    central.push(c, nameBuf);
+    offset += 30 + nameBuf.length + packed.length + 16;
+  }
+  const cd = Buffer.concat(central);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(cd.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...out, cd, end]);
+}
+
+// Re-pack a downloaded file after changing its document part (and optionally
+// other parts), in reverse entry order, the way a save by another program
+// reorders them.
+export function resave(buf, { document, drop = [], parts = {} } = {}) {
+  const all = unzipAll(buf);
+  if (document) all.set('word/document.xml', document(all.get('word/document.xml')));
+  for (const [k, v] of Object.entries(parts)) all.set(k, v);
+  for (const k of drop) all.delete(k);
+  return wordZip([...all].reverse());
+}
+
+// The paragraph that holds a line's content control, as it stands.
+const LINE_PARA = (key) => new RegExp(`<w:p>(?:(?!<w:p>).)*?<w:tag w:val="${key}"/>.*?</w:p>`, 's');
+const LINE_PARA_STYLED = (key) => new RegExp(`<w:p><w:pPr>(?:(?!<w:p>).)*?<w:tag w:val="${key}"/>.*?</w:p>`, 's');
+export function lineParagraph(xml, key) {
+  const m = LINE_PARA_STYLED(key).exec(xml) || LINE_PARA(key).exec(xml);
+  if (!m) throw new Error(`no paragraph for ${key}`);
+  return m[0];
+}
+
+// Replace the runs inside a line's content control with Word-shaped runs.
+export function typeInto(xml, key, runsXml) {
+  const para = lineParagraph(xml, key);
+  const edited = para.replace(/<w:sdtContent>[\s\S]*?<\/w:sdtContent>/, () => `<w:sdtContent>${runsXml}</w:sdtContent>`);
+  return xml.replace(para, () => edited);
+}
+
+// Word's runs for a typed sentence: each part its own run, some with
+// properties and revision ids, proofing marks between them.
+export function wordRuns(parts) {
+  return parts.map((p, i) => {
+    const rPr = i % 2 ? '<w:rPr><w:rFonts w:ascii="Calibri"/><w:lang w:val="en-GB"/></w:rPr>' : '';
+    const proof = i === 1 ? '<w:proofErr w:type="spellStart"/>' : i === 2 ? '<w:proofErr w:type="spellEnd"/>' : '';
+    return `${proof}<w:r w:rsidR="00A1B2C${i}" w:rsidRPr="00D4E5F${i}">${rPr}<w:t xml:space="preserve">${p}</w:t></w:r>`;
+  }).join('');
+}
+
+// A tracked change: the insertion is text now, the deletion is not.
+export function trackedInsert(text) {
+  return `<w:ins w:id="91" w:author="Artist" w:date="2026-09-28T10:00:00Z"><w:r><w:t xml:space="preserve">${text}</w:t></w:r></w:ins>`;
+}
+export function trackedDelete(text) {
+  return `<w:del w:id="92" w:author="Artist" w:date="2026-09-28T10:00:00Z"><w:r><w:delText xml:space="preserve">${text}</w:delText></w:r></w:del>`;
+}
+
+// Remove every content control, keeping its runs: what an editor that does
+// not keep controls leaves behind (the upload then maps by position).
+export function stripControls(xml) {
+  return xml.replace(/<w:sdt><w:sdtPr>[\s\S]*?<\/w:sdtPr><w:sdtContent>([\s\S]*?)<\/w:sdtContent><\/w:sdt>/g, (m, inner) => inner);
+}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1061",
+  "version": "1.19.1062",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1061",
+      "version": "1.19.1062",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1061",
+  "version": "1.19.1062",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7667,5 +7667,11 @@
       "id": "1004319",
       "text": "An artist's page rewrite is now saved as they type and can be submitted. The draft rests on the page's own tweak task, and saving the same words again changes nothing. Submitting freezes the rewrite for a /tweak session to app"
     }
+  ],
+  "1.19.1062": [
+    {
+      "id": "1004320",
+      "text": "An artist can now download any page's words as a Word document, work on it offline, and upload it back. The upload goes into their draft, never straight to the site, and only the lines they actually changed in Word are taken,"
+    }
   ]
 }

package/scripts/gds/fitness-checks-write-validation.js

@@ -42,6 +42,10 @@ const WRITE_VALIDATION_EXEMPT = new Set([
   'PATCH /me/render',             // { widgets: <bool>|null }      — renderPrefs.validatePatch
   'PATCH /me/display-name',       // { display_name }              — displayName.validate
   'PATCH /me/profile-nudge',      // { dismissed: <bool>|null }    — profileNudgePrefs.validatePatch
+  // Not a JSON body at all: the raw .docx bytes (task 1004320, ADR 0341 D12), capped by
+  // the route's own express.raw parser and read by docx.readUpload, which refuses
+  // anything that is not a bounded, readable Word file (not_a_docx / upload_too_large).
+  'POST /copy-desk/pages/:pageId/draft.docx',
 ]);
 
 // KNOWN GAPS, NOT EXEMPTIONS (task 1002551 / BV1.R109b → tracked by task 1002552).

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1061'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1062'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/copy_desk_page_docx.mjs

@@ -0,0 +1,279 @@
+// tests/copy_desk_page_docx.mjs — download a page as .docx, edit it the way
+// Word stores an edit, and upload it back into the draft, the WHOLE path (task
+// 1004320 / BV2.TW09, ADR 0341 D12).
+//
+// The done-when: a round trip with edits lands those edits in the draft, and a
+// structure-changing upload is refused by name.
+//
+// Driven through the real copy-desk routes (with the real raw-body parser and
+// its cap), the real lifecycle port (the page claim, updateHeldTaskDescription,
+// submitPageTweak, createTask) and the real page reads, against the shared
+// stateful fake ledger (tests/fixtures/page-ledger.mjs). The reading is a file
+// on disk, read through the real page-data.js. The file is edited by the
+// Word-shaped fixture, which re-packs it with its own zip writer.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+import { installPageLedger } from './fixtures/page-ledger.mjs';
+import { resave, typeInto, wordRuns, lineParagraph } from '../modules/copy-desk/tests/fixtures/word-docx.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const F = require('../modules/copy-desk/tests/fixtures/page-tweak.cjs');
+const pages = require('../modules/copy-desk/pages.js');
+const docx = require('../modules/copy-desk/docx.js');
+const api = require('../src/module-api.js');
+
+const { db } = installPageLedger(api, {
+  builders: [
+    { id: '7', github_login: 'alice', display_name: 'Alice', preferred_disciplines: ['artist'] },
+    { id: '8', github_login: 'bob', display_name: 'Bob', preferred_disciplines: ['artist'] },
+  ],
+});
+const ALICE = '7';
+const BOB = '8';
+
+api.requireBuilder = (req, res, next) => {
+  req.builder = { id: String(req.headers['x-builder'] || ALICE), rank: 'metic' };
+  next();
+};
+
+const seams = require('../src/module-seams.js');
+const lifecyclePort = require('../modules/lifecycle/lifecycle.js');
+if (!seams.hasProvider('lifecycle')) seams.registerProvider('lifecycle', lifecyclePort);
+
+const pageData = require('../modules/copy-desk/page-data.js');
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildRouter = require('../modules/copy-desk/routes/copy-desk.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildRouter());
+const server = await new Promise((resolve) => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function call(method, p, builder, body = {}) {
+  const r = await fetch(base + p, { method, headers: { 'content-type': 'application/json', 'x-builder': builder }, body: method === 'GET' ? undefined : JSON.stringify(body) });
+  return { status: r.status, body: await r.json() };
+}
+async function getDocx(p, builder) {
+  const r = await fetch(base + p, { headers: { 'x-builder': builder } });
+  return { status: r.status, headers: r.headers, buf: Buffer.from(await r.arrayBuffer()) };
+}
+async function putDocx(p, builder, buf, type = docx.DOCX_MIME) {
+  const r = await fetch(base + p, { method: 'POST', headers: { 'content-type': type, 'x-builder': builder }, body: buf });
+  return { status: r.status, body: await r.json() };
+}
+const errCode = (b) => (b && b.error && b.error.code) || null;
+const errDetail = (b) => (b && b.error && b.error.details) || {};
+
+const L = (key, section, text, placement, row) => ({ key, section, text, placement, ...(row || {}) });
+const STUDIO_LINES = [
+  L('L0001', 'top bar', 'Studio', 'shared', { file: 'modules/hall-ui/public/shell.js', line: 40, string_id: 'sh0001' }),
+  L('L0002', 'top bar', 'Ctrl K', 'shared'),
+  L('L0003', 'greeting', 'Welcome back', 'placed', { file: 'modules/hall-ui/public/studio.html', line: 12, string_id: 'st0003' }),
+  L('L0004', 'greeting', '{…} pages tweaked', 'placed', { file: 'modules/hall-ui/public/studio.js', line: 88, string_id: 'st0004' }),
+  L('L0005', 'greeting', 'Your desk is quiet today', 'unplaced'),
+  L('L0006', 'footer', 'Resume where you left off', 'placed', { file: 'modules/hall-ui/public/studio.html', line: 90, string_id: 'st0006' }),
+];
+const INDEX_LINES = [
+  L('L0001', 'hero', 'Build here', 'placed', { file: 'modules/public-landing/public/index.html', line: 3, string_id: 'ix0001' }),
+];
+const readingsWith = (studioHash) => ({
+  schema: 1,
+  pages: [
+    { id: 'builders:studio', reading_hash: studioHash, lines: STUDIO_LINES },
+    { id: 'landing:index', reading_hash: 'index-h1', lines: INDEX_LINES },
+  ],
+});
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'page-docx-'));
+fs.mkdirSync(path.join(tmp, 'docs'), { recursive: true });
+fs.writeFileSync(path.join(tmp, 'docs/page-inventory.json'), JSON.stringify(F.INVENTORY));
+function writeReadings(r) {
+  fs.writeFileSync(path.join(tmp, 'docs/page-readings.json'), JSON.stringify(r));
+  pageData._setRoot(tmp); // drop the (mtime, size) cache
+}
+
+const { test, summary } = makeRunner();
+const STUDIO = '/copy-desk/pages/builders:studio';
+const INDEX = '/copy-desk/pages/landing:index';
+const studioTask = () => db.tasks.find((t) => t.source_ref === 'page-tweak/builders:studio/r1');
+const draftLines = () => pages.parseDraftBlock(studioTask().description).draft.lines.map((l) => [l.key, l.before, l.after]);
+let downloaded = null;
+
+try {
+  writeReadings(readingsWith('studio-h1'));
+
+  await test('the download works before anyone claims the page: the reading, as a Word file', async () => {
+    const r = await getDocx(`${INDEX}/draft.docx`, BOB);
+    assert.equal(r.status, 200);
+    assert.equal(r.headers.get('content-type'), docx.DOCX_MIME);
+    assert.equal(r.headers.get('content-disposition'), 'attachment; filename="tweak-landing-index.docx"');
+    const u = docx.readUpload(r.buf);
+    assert.equal(u.ok, true);
+    assert.equal(u.page_id, 'landing:index');
+    assert.deepEqual([...u.baseline], [['L0001', 'Build here']]);
+  });
+
+  await test('the download is built from the reading plus the artist\'s current draft', async () => {
+    assert.equal((await call('POST', `${STUDIO}/claim`, ALICE)).status, 201);
+    const saved = await call('PUT', `${STUDIO}/draft`, ALICE, { reading_hash: 'studio-h1', lines: [{ key: 'L0003', after: 'Welcome home' }] });
+    assert.equal(saved.body.outcome, 'saved');
+    const r = await getDocx(`${STUDIO}/draft.docx`, ALICE);
+    assert.equal(r.status, 200);
+    downloaded = r.buf;
+    const u = docx.readUpload(r.buf);
+    assert.deepEqual([u.page_id, u.reading_hash], ['builders:studio', 'studio-h1']);
+    assert.equal(u.baseline.get('L0003'), 'Welcome home', 'the draft rewrite, not the page text');
+    assert.equal(u.baseline.get('L0006'), 'Resume where you left off');
+    assert.deepEqual(u.paragraphs.filter((p) => p.tags.length).map((p) => p.tags[0]), STUDIO_LINES.map((l) => l.key));
+  });
+
+  await test('a round trip with edits (Word\'s split runs and smart quotes) lands those edits in the draft', async () => {
+    const writes = db.writes;
+    const edited = resave(downloaded, {
+      document: (xml) => typeInto(typeInto(xml, 'L0006', wordRuns(['Pick ', 'up where ', 'you’re ', 'at'])),
+        'L0004', wordRuns(['{…} ', 'pages rewritten'])),
+    });
+    const r = await putDocx(`${STUDIO}/draft.docx`, ALICE, edited);
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.equal(r.body.outcome, 'saved');
+    assert.deepEqual(r.body.merge, { mode: 'tag', baseline: true, from_file: ['L0004', 'L0006'], kept_from_draft: ['L0003'] });
+    assert.deepEqual(r.body.counter, { changed: 3, total: 6 });
+    assert.deepEqual(draftLines(), [
+      ['L0003', 'Welcome back', 'Welcome home'],
+      ['L0004', '{…} pages tweaked', '{…} pages rewritten'],
+      ['L0006', 'Resume where you left off', 'Pick up where you\'re at'],
+    ]);
+    // Into the DRAFT and nowhere else: one write, the round still writing,
+    // no frozen batch, one draft block, and the reading on disk untouched.
+    assert.equal(db.writes, writes + 1);
+    assert.equal(studioTask().status, 'active');
+    assert.equal(pages.blockPresence(studioTask().description).batch, false);
+    assert.equal((studioTask().description.match(/```page-tweak-draft/g) || []).length, 1);
+    assert.deepEqual(JSON.parse(fs.readFileSync(path.join(tmp, 'docs/page-readings.json'), 'utf8')), readingsWith('studio-h1'));
+  });
+
+  await test('the same upload again writes nothing', async () => {
+    const writes = db.writes;
+    const stamp = studioTask().updated_at;
+    const edited = resave(downloaded, {
+      document: (xml) => typeInto(typeInto(xml, 'L0006', wordRuns(['Pick ', 'up where ', 'you’re ', 'at'])),
+        'L0004', wordRuns(['{…} ', 'pages rewritten'])),
+    });
+    const r = await putDocx(`${STUDIO}/draft.docx`, ALICE, edited);
+    assert.equal(r.body.outcome, 'unchanged');
+    assert.equal(db.writes, writes);
+    assert.equal(studioTask().updated_at, stamp);
+  });
+
+  await test('a rewrite made in the studio after the download survives an upload of the older file', async () => {
+    // The artist keeps working in the studio (a whole-draft save), then
+    // uploads the file they downloaded earlier with one more Word edit.
+    const saved = await call('PUT', `${STUDIO}/draft`, ALICE, { reading_hash: 'studio-h1', lines: [{ key: 'L0003', after: 'Hello again' }, { key: 'L0005', after: 'Nothing is waiting' }] });
+    assert.equal(saved.body.outcome, 'saved');
+    const edited = resave(downloaded, { document: (xml) => typeInto(xml, 'L0001', wordRuns(['Your ', 'studio'])) });
+    const r = await putDocx(`${STUDIO}/draft.docx`, ALICE, edited);
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.deepEqual(r.body.merge.from_file, ['L0001']);
+    assert.deepEqual(draftLines().map(([k, , a]) => [k, a]), [
+      ['L0001', 'Your studio'],
+      ['L0003', 'Hello again'],
+      ['L0005', 'Nothing is waiting'],
+    ]);
+  });
+
+  await test('a structure-changing upload is refused by name, and nothing is saved', async () => {
+    const writes = db.writes;
+    const buf = resave(downloaded, {
+      document: (xml) => {
+        const p = lineParagraph(xml, 'L0003');
+        return xml.replace(lineParagraph(xml, 'L0005'), '').replace(p, () => `${p}<w:p><w:r><w:t>An extra thought</w:t></w:r></w:p>`);
+      },
+    });
+    const r = await putDocx(`${STUDIO}/draft.docx`, ALICE, buf);
+    assert.equal(r.status, 409);
+    assert.equal(errCode(r.body), 'structure_changed');
+    assert.deepEqual(errDetail(r.body).moved, [
+      { change: 'added', key: null, section: 'greeting', first_words: 'An extra thought' },
+      { change: 'dropped', key: 'L0005', section: 'greeting', first_words: 'Your desk is quiet today' },
+    ]);
+    assert.match(errDetail(r.body).what_this_means, /added, removed or moved/);
+    assert.equal(db.writes, writes);
+  });
+
+  await test('another page\'s file is wrong_page; a file from an older reading is reading_moved', async () => {
+    assert.equal((await call('POST', `${INDEX}/claim`, BOB)).status, 201);
+    const wrong = await putDocx(`${INDEX}/draft.docx`, BOB, downloaded);
+    assert.equal(wrong.status, 409);
+    assert.equal(errCode(wrong.body), 'wrong_page');
+    assert.equal(errDetail(wrong.body).file_page_id, 'builders:studio');
+
+    writeReadings(readingsWith('studio-h2'));
+    const moved = await putDocx(`${STUDIO}/draft.docx`, ALICE, downloaded);
+    assert.equal(moved.status, 409);
+    assert.equal(errCode(moved.body), 'reading_moved');
+    assert.deepEqual([errDetail(moved.body).reading_hash, errDetail(moved.body).file_reading_hash], ['studio-h2', 'studio-h1']);
+    writeReadings(readingsWith('studio-h1'));
+  });
+
+  await test('only the holder may upload: page_not_held names the holder', async () => {
+    const r = await putDocx(`${STUDIO}/draft.docx`, BOB, downloaded);
+    assert.equal(r.status, 409);
+    assert.equal(errCode(r.body), 'page_not_held');
+    assert.deepEqual(errDetail(r.body).holder, { id: ALICE, login: 'alice', name: 'Alice' });
+  });
+
+  await test('the upload is user input: anything not a .docx is refused, and the size is capped', async () => {
+    const writes = db.writes;
+    const json = await call('POST', `${STUDIO}/draft.docx`, ALICE, { lines: [] });
+    assert.equal(json.status, 415);
+    assert.equal(errCode(json.body), 'not_a_docx');
+    const text = await putDocx(`${STUDIO}/draft.docx`, ALICE, Buffer.from('hello'), 'text/plain');
+    assert.equal(errCode(text.body), 'not_a_docx');
+    const junk = await putDocx(`${STUDIO}/draft.docx`, ALICE, Buffer.from('not a zip at all'));
+    assert.equal(junk.status, 415);
+    assert.equal(errCode(junk.body), 'not_a_docx');
+    const zip = await putDocx(`${STUDIO}/draft.docx`, ALICE, docx.writeZip([{ name: 'notes.txt', data: 'hi' }]), 'application/zip');
+    assert.equal(errCode(zip.body), 'not_a_docx');
+    const big = await putDocx(`${STUDIO}/draft.docx`, ALICE, Buffer.alloc(docx.MAX_UPLOAD_BYTES + 1024, 7));
+    assert.equal(big.status, 413);
+    assert.equal(errCode(big.body), 'upload_too_large');
+    assert.equal(db.writes, writes);
+  });
+
+  await test('no round is no_open_round; after submit the draft is frozen, so an upload is page_in_flight', async () => {
+    const indexFile = (await getDocx(`${INDEX}/draft.docx`, BOB)).buf;
+    // Bob holds index; a page nobody opened a round on has nowhere to land.
+    const inv = F.INVENTORY.pages.find((p) => p.id !== 'builders:studio' && p.id !== 'landing:index');
+    assert.ok(inv, 'the fixture inventory has a page with no round');
+    const readings = readingsWith('studio-h1');
+    readings.pages.push({ id: inv.id, reading_hash: 'x-h1', lines: [L('L0001', 'hero', 'Hi', 'placed', { file: 'f', line: 1, string_id: 's' })] });
+    writeReadings(readings);
+    const other = (await getDocx(`/copy-desk/pages/${inv.id}/draft.docx`, BOB)).buf;
+    const none = await putDocx(`/copy-desk/pages/${inv.id}/draft.docx`, BOB, other);
+    assert.equal(errCode(none.body), 'no_open_round');
+    writeReadings(readingsWith('studio-h1'));
+    const edited = resave(indexFile, { document: (xml) => typeInto(xml, 'L0001', wordRuns(['Build ', 'it here'])) });
+    assert.equal((await putDocx(`${INDEX}/draft.docx`, BOB, edited)).body.outcome, 'saved');
+    assert.equal((await call('POST', `${INDEX}/submit`, BOB)).body.outcome, 'submitted');
+    const after = await putDocx(`${INDEX}/draft.docx`, BOB, edited);
+    assert.equal(after.status, 409);
+    assert.equal(errCode(after.body), 'page_in_flight');
+    // The submitted batch carries the Word edit, with its target from the reading.
+    const t = db.tasks.find((x) => x.source_ref === 'page-tweak/landing:index/r1');
+    assert.deepEqual(pages.parseBatchBlock(t.description).batch.lines.map((l) => [l.key, l.file, l.before, l.after]),
+      [['L0001', 'modules/public-landing/public/index.html', 'Build here', 'Build it here']]);
+  });
+} finally {
+  server.close();
+  pageData._setRoot(null);
+}
+summary();

package/tests/fitness.mjs

@@ -922,9 +922,14 @@ test('write-route validation check actually CATCHES an unvalidated write route (
   assert.ok(/POST \/widgets/.test(flagged[0]), 'the offending route is named');
 });
 
-test('write-route validation exemptions are the known dynamic-key prefs routes only', () => {
+test('write-route validation exemptions are the known dynamic-key prefs routes, plus the one raw-file upload', () => {
+  // The .docx upload (task 1004320) has no JSON body to hold a field schema: its
+  // body is the file's bytes, capped by the route's parser and read by
+  // docx.readUpload. Named here so a second raw-body exemption is a reviewed diff.
+  const RAW_FILE_UPLOADS = ['POST /copy-desk/pages/:pageId/draft.docx'];
   const exempt = [...fitness.WRITE_VALIDATION_EXEMPT];
-  assert.ok(exempt.length >= 1 && exempt.every((e) => e.startsWith('PATCH /me/')), 'exemptions are all /me/* prefs patches: ' + exempt.join(', '));
+  assert.ok(exempt.length >= 1 && exempt.every((e) => e.startsWith('PATCH /me/') || RAW_FILE_UPLOADS.includes(e)),
+    'exemptions are all /me/* prefs patches or a named raw-file upload: ' + exempt.join(', '));
 });
 
 test('identity gate strips comments on CRLF checkouts too (task 1002428)', () => {