@bongos/core 1.19.1081 → 1.20.1

package/tests/hub_account_page.mjs

@@ -0,0 +1,394 @@
+// tests/hub_account_page.mjs — the hub's account page (task 1004259, ADR 0337 D4.3;
+// spec docs/specs/hub-account-settings-inventory.md).
+//
+// The hub account is the person and a hall account is their seat in one project,
+// so what belongs to the person — handle, name, bio, links, who can find them — is
+// edited on ONE page at the apex, and every hall links out to it. These pin:
+//   1. the page as a file: portable, dark only, no page :root, no innerHTML, the
+//      sign-in door returns here, and it calls only the four own-scoped routes;
+//   2. its limits mirror the module's (bio cap, the link vocabulary and host pins);
+//   3. its script, EXECUTED in a node:vm under a DOM stub: the door on a 401, the
+//      paint from the server's answer, and each save sending only what changed —
+//      and a bad link or an empty name refused at the field, before any request;
+//   4. the route: served on the apex only where platform-identity runs, never on
+//      the builders/status hosts, and never on a child instance;
+//   5. the hall's side: the two privacy sections are gone, one link-out row
+//      remains, and its hub origin is a bare https origin or nothing.
+//
+// DB-free. Run:  node --test tests/hub_account_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const PAGE = fs.readFileSync(path.join(LANDING, 'account.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
+
+// ── 1. the page as a file ────────────────────────────────────────────────────
+
+test('portable and dark only: stamped title, balanced sentinels, no :root, no baked apex', () => {
+  assert.match(PAGE, /^<html lang="en" data-mode="dark">/m, 'dark is fixed on <html> (ADR 0204)');
+  assert.match(PAGE, /<title>\{\{productName\}\} — Your account<\/title>/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/, 'a private edit surface is not for a crawler');
+  const styles = [...PAGE.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
+  assert.doesNotMatch(styles, /:root\s*\{/, 'a page-local :root outranks the injected pack');
+  assert.doesNotMatch(styles, /#[0-9a-f]{3,8}\b/i, 'every colour is a token, never a literal');
+  assert.doesNotMatch(PAGE, /cloudbongos\.com/, 'no hardcoded apex — the file ships to every instance');
+  assert.doesNotMatch(PAGE, /gtag|plausible|googletagmanager/);
+  const starts = (PAGE.match(/<!--apex-only:start-->/g) || []).length;
+  assert.equal(starts, (PAGE.match(/<!--apex-only:end-->/g) || []).length, 'balanced sentinels');
+  const stamped = applyBrandTokens(PAGE, { identity: { productName: 'Spike Harbor' } }, 'https://spike.example', 'https://builders.spike.example', '');
+  assert.doesNotMatch(stamped, /\{\{[a-zA-Z]+\}\}/, 'every token stamps');
+  assert.match(stamped, /<title>Spike Harbor — Your account<\/title>/);
+});
+
+test('the script builds no markup from strings, and the controls are real markup', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML/, 'live DOM is textContent / createElement only');
+  for (const id of ['fName', 'fBio', 'fHandle', 'fLinkWebsite', 'fLinkX', 'fLinkLinkedin', 'fLinkDiscord', 'profileSave', 'handleSave', 'privacySave', 'recordSave']) {
+    assert.match(PAGE, new RegExp(`id="${id}"`), `#${id} ships in the markup`);
+  }
+  for (const [name, values] of [['visibility', ['public', 'private']], ['recruiters', ['on', 'off']], ['record', ['show', 'hide']]]) {
+    for (const v of values) assert.match(PAGE, new RegExp(`<input type="radio" name="${name}" value="${v}">`));
+  }
+  assert.match(PAGE, /<div id="acctBody" hidden>/, 'the signed-in body ships hidden');
+  assert.match(PAGE, /<section class="aDoor" id="door" hidden/, 'and so does the door');
+});
+
+test('the door returns here, and the page calls only its own-scoped routes', () => {
+  assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account"/, 'sign-in lands back on /account');
+  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile'].sort());
+  assert.match(SCRIPT, /fetch\(API \+ '\/auth\/logout', \{ method: 'POST'/, 'sign out is the hub logout POST');
+});
+
+// ── 2. the mirrors hold ──────────────────────────────────────────────────────
+
+test('the page’s limits are the module’s own (boundary-forced copies)', () => {
+  const grab = (name) => {
+    const m = SCRIPT.match(new RegExp(`var ${name} = ([^;]+);`));
+    assert.ok(m, `${name} is still declared`);
+    // JSON round-trip: a value built in another vm context has other prototypes
+    return JSON.parse(JSON.stringify(vm.runInNewContext(`(${m[1]})`)));
+  };
+  assert.equal(grab('BIO_MAX'), pi.BIO_MAX_CHARS);
+  assert.deepEqual(grab('LINK_TYPES'), [...pi.PROFILE_LINK_TYPES]);
+  assert.deepEqual(grab('LINK_HOSTS'), JSON.parse(JSON.stringify(pi.PROFILE_LINK_HOSTS)));
+  assert.match(PAGE, new RegExp(`id="fName" maxlength="${pi.DISPLAY_NAME_MAX_CHARS}"`));
+  assert.match(PAGE, /id="fHandle" maxlength="39"/, 'the handle charset caps at 39, like github_login');
+});
+
+// ── 3. the script, executed ──────────────────────────────────────────────────
+
+const ACCOUNT = () => ({
+  hide_stats: false, profile_state: 'active', account_visibility: 'public',
+  recruiter_discoverable: null, recruiter_discoverable_effective: true,
+  handle: 'octo', display_name: 'Octo', bio: 'Old bio.',
+  links: { website: 'https://octo.example/' },
+  cross_project: { projects: [], totals: { projects: 2, credits: 40, works_shipped: 5, karma: 3 } },
+});
+
+// A DOM stub just wide enough for this page: every id in the markup is an
+// element (hidden where the markup says so), every radio and link input is
+// addressable by the selectors the script uses, and fetch answers from a handler.
+function boot(answer) {
+  const els = new Map();
+  const listeners = (o) => { o._on = {}; o.addEventListener = (t, f) => { (o._on[t] ||= []).push(f); }; return o; };
+  const el = (id, hidden) => listeners({
+    id, hidden, value: '', textContent: '', className: '', disabled: false, style: {},
+    appendChild(c) { this.textContent += c.textContent; return c; },
+    getAttribute() { return null; },
+    focus() { dom.focused = id; },
+  });
+  for (const m of PAGE.matchAll(/<(\w+)([^>]*?)\sid="([\w-]+)"([^>]*)>/g)) {
+    els.set(m[3], el(m[3], /\shidden\b/.test(m[2] + m[4])));
+  }
+  const radios = [...PAGE.matchAll(/<input type="radio" name="(\w+)" value="(\w+)">/g)]
+    .map((m) => listeners({ name: m[1], value: m[2], checked: false }));
+  const links = [...PAGE.matchAll(/id="(fLink\w+)" data-link="(\w+)"/g)].map((m) => {
+    const e = els.get(m[1]);
+    e.getAttribute = (n) => (n === 'data-link' ? m[2] : null);
+    return e;
+  });
+  const calls = [];
+  const dom = {
+    els, radios, calls, focused: null,
+    pick(name, value) {
+      for (const r of radios.filter((x) => x.name === name)) r.checked = r.value === value;
+      for (const f of radios.find((x) => x.name === name && x.value === value)._on.change || []) f({});
+    },
+    submit(id) { for (const f of els.get(id)._on.submit || []) f({ preventDefault() {} }); },
+    text: (id) => els.get(id).textContent,
+  };
+  const document = {
+    cookie: '',
+    getElementById: (id) => els.get(id) || null,
+    querySelector(sel) {
+      const m = sel.match(/^input\[name="(\w+)"\]:checked$/);
+      if (!m) throw new Error(`unstubbed selector: ${sel}`);
+      return radios.find((r) => r.name === m[1] && r.checked) || null;
+    },
+    querySelectorAll(sel) {
+      if (sel === '#profileForm [data-link]') return links;
+      const names = [...sel.matchAll(/input\[name="(\w+)"\]/g)].map((m) => m[1]);
+      if (!names.length) throw new Error(`unstubbed selector: ${sel}`);
+      return radios.filter((r) => names.includes(r.name));
+    },
+    createElement: () => ({ className: '', textContent: '' }),
+  };
+  const fetch = (url, init = {}) => {
+    const method = init.method || 'GET';
+    const body = init.body ? JSON.parse(init.body) : undefined;
+    const p = url.replace(/^\/api\/bongos/, '');
+    calls.push({ method, path: p, body });
+    const { status, data } = answer(method, p, body);
+    return Promise.resolve({ status, ok: status >= 200 && status < 300, json: () => Promise.resolve(data) });
+  };
+  const location = { hostname: 'cloudbongos.com', pathname: '/account' };
+  vm.runInNewContext(SCRIPT, { document, fetch, location, window: { location: { assign() {} } }, URL, Array, Object, JSON, Promise });
+  return dom;
+}
+const settle = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r)); };
+
+test('signed out: a 401 opens the door and shows nothing else', async () => {
+  const dom = boot(() => ({ status: 401, data: { error: { code: 'unauthenticated' } } }));
+  await settle();
+  assert.equal(dom.els.get('door').hidden, false);
+  assert.equal(dom.els.get('acctBody').hidden, true);
+  assert.equal(dom.els.get('aWho').hidden, true);
+  assert.equal(dom.els.get('loading').hidden, true);
+});
+
+test('signed in: every control is painted from the server’s answer', async () => {
+  const dom = boot((m, p) => (m === 'GET' && p === '/me/cross-project' ? { status: 200, data: ACCOUNT() } : { status: 500, data: null }));
+  await settle();
+  assert.equal(dom.els.get('acctBody').hidden, false);
+  assert.equal(dom.els.get('door').hidden, true);
+  assert.equal(dom.text('whoName'), 'octo');
+  assert.equal(dom.els.get('fName').value, 'Octo');
+  assert.equal(dom.els.get('fBio').value, 'Old bio.');
+  assert.equal(dom.els.get('fLinkWebsite').value, 'https://octo.example/');
+  assert.equal(dom.els.get('fHandle').value, 'octo');
+  assert.equal(dom.text('bioCount'), '8 of 280 characters');
+  const checked = (n) => dom.radios.find((r) => r.name === n && r.checked).value;
+  assert.equal(checked('visibility'), 'public');
+  assert.equal(checked('recruiters'), 'on', 'the EFFECTIVE answer, since the stored one is null');
+  assert.equal(checked('record'), 'show');
+  assert.equal(dom.text('recordLine'), 'Your record: 2 projects · 40 credits · 5 works shipped · 3 karma.');
+  assert.match(dom.text('recWhat'), /^They will see your name, your picture, your roles/);
+  assert.match(dom.text('recWhat'), /For now this follows your profile page setting\.$/, 'a null answer says it follows');
+});
+
+test('the recruiter copy follows the choices on the page: private adds the exception, hidden shrinks the grant', async () => {
+  const dom = boot(() => ({ status: 200, data: ACCOUNT() }));
+  await settle();
+  assert.doesNotMatch(dom.text('recWhat'), /while your profile page is private/);
+  dom.pick('visibility', 'private');
+  assert.match(dom.text('recWhat'), /This is the one thing a recruiter can see while your profile page is private\./);
+  dom.pick('record', 'hide');
+  assert.match(dom.text('recWhat'), /^Because your cross-project record is hidden, they will see your name and your picture, and nothing else\./);
+});
+
+test('your profile: only what changed is sent, and nothing changed sends nothing', async () => {
+  const dom = boot((m, p, body) => {
+    if (m === 'GET') return { status: 200, data: ACCOUNT() };
+    if (m === 'PATCH' && p === '/me/profile') return { status: 200, data: { display_name: 'Octo', bio: body.bio, links: body.links } };
+    return { status: 500, data: null };
+  });
+  await settle();
+  dom.submit('profileForm');
+  await settle();
+  assert.equal(dom.text('profileMsg'), 'Nothing has changed.');
+  assert.equal(dom.calls.filter((c) => c.method === 'PATCH').length, 0);
+
+  dom.els.get('fBio').value = '  A new bio.  ';
+  dom.els.get('fLinkLinkedin').value = 'https://www.linkedin.com/in/octo';
+  dom.submit('profileForm');
+  await settle();
+  const patch = dom.calls.find((c) => c.method === 'PATCH');
+  assert.deepEqual(patch, { method: 'PATCH', path: '/me/profile', body: {
+    bio: 'A new bio.',
+    links: { website: 'https://octo.example/', linkedin: 'https://www.linkedin.com/in/octo' },
+  } }, 'no display_name — it did not change; the link set is sent whole, as the route replaces it');
+  assert.equal(dom.text('profileMsg'), 'Saved — your profile shows this everywhere now.');
+  assert.equal(dom.els.get('profileMsg').className, 'projMsg ok');
+});
+
+test('your profile: a link off its site, a plain-http link and an empty name are named at the field, before any request', async () => {
+  const dom = boot(() => ({ status: 200, data: ACCOUNT() }));
+  await settle();
+  dom.els.get('fLinkLinkedin').value = 'https://linkedin.com.evil.example/in/octo';
+  dom.submit('profileForm');
+  assert.equal(dom.text('profileMsg'), 'Your LinkedIn link has to point at linkedin.com.');
+  assert.equal(dom.focused, 'fLinkLinkedin');
+  dom.els.get('fLinkLinkedin').value = 'http://linkedin.com/in/octo';
+  dom.submit('profileForm');
+  assert.equal(dom.text('profileMsg'), 'Your LinkedIn link has to start with https://.');
+  dom.els.get('fLinkLinkedin').value = '';
+  dom.els.get('fName').value = '   ';
+  dom.submit('profileForm');
+  assert.equal(dom.text('profileMsg'), 'Your display name can’t be empty.');
+  assert.equal(dom.calls.filter((c) => c.method === 'PATCH').length, 0, 'nothing was sent');
+});
+
+test('your profile: the server’s refusal is shown in its own words', async () => {
+  const dom = boot((m) => (m === 'GET' ? { status: 200, data: ACCOUNT() }
+    : { status: 400, data: { error: { code: 'bio_too_long', message: 'a bio is at most 280 characters of plain text' } } }));
+  await settle();
+  dom.els.get('fBio').value = 'short';
+  dom.submit('profileForm');
+  await settle();
+  assert.equal(dom.text('profileMsg'), 'A bio is at most 280 characters of plain text.');
+  assert.equal(dom.els.get('profileMsg').className, 'projMsg err');
+  assert.equal(dom.els.get('profileSave').disabled, false, 'the button comes back for another try');
+});
+
+test('your handle: lowercased, the same handle is not re-sent, and each refusal is said plainly', async () => {
+  let reply = { status: 409, data: { error: { code: 'handle_taken', message: 'that handle is already in use' } } };
+  const dom = boot((m) => (m === 'GET' ? { status: 200, data: ACCOUNT() } : reply));
+  await settle();
+  dom.els.get('fHandle').value = 'OCTO';
+  dom.submit('handleForm');
+  assert.equal(dom.text('handleMsg'), 'That is already your handle.');
+  dom.els.get('fHandle').value = ' Taken ';
+  dom.submit('handleForm');
+  await settle();
+  assert.deepEqual(dom.calls.at(-1), { method: 'PATCH', path: '/me/handle', body: { handle: 'taken' } });
+  assert.equal(dom.text('handleMsg'), 'Someone already has that handle — pick another.');
+  reply = { status: 429, data: { error: { code: 'handle_rate_limited', message: 'handles change at most once per 7 days — try again after 2026-10-06T00:00:00.000Z' } } };
+  dom.submit('handleForm');
+  await settle();
+  assert.equal(dom.text('handleMsg'), 'You can change your handle once a week, and you changed it recently — try again in a few days.');
+  reply = { status: 200, data: { handle: 'taken', previous_handle: 'octo' } };
+  dom.submit('handleForm');
+  await settle();
+  assert.equal(dom.text('handleMsg'), 'Saved — your handle is now taken.');
+});
+
+test('who can find you: sends only the flag that moved, then re-reads the server’s view', async () => {
+  let acct = ACCOUNT();
+  const dom = boot((m, p, body) => {
+    if (m === 'GET') return { status: 200, data: acct };
+    acct = { ...acct, ...body, recruiter_discoverable: null, recruiter_discoverable_effective: false };
+    return { status: 200, data: {} };
+  });
+  await settle();
+  dom.submit('privacyForm');
+  assert.equal(dom.text('privacyMsg'), 'Nothing has changed.');
+  dom.pick('visibility', 'private');
+  dom.submit('privacyForm');
+  await settle();
+  const patches = dom.calls.filter((c) => c.method === 'PATCH');
+  assert.deepEqual(patches, [{ method: 'PATCH', path: '/me/cross-project', body: { account_visibility: 'private' } }],
+    'reach was left alone, so it is not sent — the route resets it to follow a now-private page');
+  assert.equal(dom.calls.at(-1).method, 'GET', 'and the page re-reads rather than trusting its own guess');
+  assert.equal(dom.text('privacyMsg'), 'Saved — your profile page is set to private.');
+  assert.equal(dom.radios.find((r) => r.name === 'recruiters' && r.checked).value, 'off', 'the effective answer repaints from the server');
+});
+
+test('your record: hiding sends hide_stats alone', async () => {
+  const dom = boot((m) => (m === 'GET' ? { status: 200, data: ACCOUNT() } : { status: 200, data: {} }));
+  await settle();
+  dom.pick('record', 'hide');
+  dom.submit('recordForm');
+  await settle();
+  assert.deepEqual(dom.calls.find((c) => c.method === 'PATCH').body, { hide_stats: true });
+  assert.equal(dom.text('recordMsg'), 'Cross-project record hidden — removed from your profile and directories immediately.');
+});
+
+test('a session that expired mid-edit reopens the door instead of failing silently', async () => {
+  const dom = boot((m) => (m === 'GET' ? { status: 200, data: ACCOUNT() } : { status: 401, data: null }));
+  await settle();
+  dom.els.get('fBio').value = 'changed';
+  dom.submit('profileForm');
+  await settle();
+  assert.equal(dom.text('profileMsg'), 'Your session expired — sign in again to save.');
+  assert.equal(dom.els.get('door').hidden, false);
+});
+
+// ── 4. the route ─────────────────────────────────────────────────────────────
+
+const { buildPlatformApp } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /account: served on the hub’s apex, stamped; never on a child, the builders host or the status host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  const child = await get('/account', 'game.test.local');
+  assert.equal(child.status, 404, 'a child instance has no platform account to edit, so no page');
+  modules.setModuleOverrides({ 'platform-identity': true });
+  const hub = await get('/account', 'game.test.local');
+  assert.equal(hub.status, 200);
+  assert.match(hub.body, /— Your account<\/title>/);
+  assert.match(hub.body, /window\.__BRANDING__=/);
+  assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/);
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    const other = await get('/account', host);
+    assert.doesNotMatch(other.body, /— Your account<\/title>/, `${host} must not serve /account`);
+  }
+});
+
+// ── 5. the hall's side: one link-out row ─────────────────────────────────────
+
+const HALL_HTML = fs.readFileSync(path.join(HALL, 'settings.html'), 'utf8');
+const HALL_JS = fs.readFileSync(path.join(HALL, 'settings.js'), 'utf8');
+
+test('the hall keeps no copy of the privacy controls — one hidden row links out to the hub', () => {
+  for (const gone of ['cross-project-scroll', 'privacy-scroll', 'cross-project-rows', 'privacy-rows']) {
+    assert.ok(!HALL_HTML.includes(`id="${gone}"`), `settings.html still carries #${gone}`);
+  }
+  assert.doesNotMatch(HALL_JS, /\/me\/cross-project/, 'the hall no longer reads or writes the account flags');
+  assert.match(HALL_HTML, /<section class="scroll" id="account-hub-scroll"[^>]*data-group="account" hidden>/);
+  assert.match(HALL_HTML, /<meta name="hub-origin" content="\{\{hubOrigin\}\}">/, 'the hub origin is stamped server-side');
+  assert.match(HALL_JS, /const origin = window\.OTB\.hubOrigin\(\);/, 'the one shared hub-origin reader (dom-utils.js), not a private copy');
+  assert.match(HALL_JS, /link\.href = `\$\{origin\}\/account`;/);
+  for (const anchor of ['cross-project', 'privacy', 'profile-privacy']) {
+    assert.match(HALL_JS, new RegExp(`'${anchor}': 'account-hub-scroll'`), `old deep link #${anchor} lands on the row`);
+  }
+});
+
+test('the hall trusts only a bare https hub origin (OTB.hubOrigin, shared by Settings and the profile nudge)', () => {
+  const DOM_UTILS = fs.readFileSync(path.join(HALL, 'dom-utils.js'), 'utf8');
+  const fn = DOM_UTILS.match(/  function hubOrigin\(\) \{[\s\S]*?\n  \}\n/);
+  assert.ok(fn, 'hubOrigin() is a whole function in dom-utils.js');
+  assert.match(DOM_UTILS, /\n    hubOrigin, \/\/ task 1003485/, 'and it is exported on window.OTB');
+  const origin = (content) => vm.runInNewContext(`${fn[0]}; hubOrigin()`, {
+    URL, document: { querySelector: () => ({ getAttribute: () => content }) },
+  });
+  assert.equal(origin('https://cloudbongos.com'), 'https://cloudbongos.com');
+  assert.equal(origin('https://cloudbongos.com/'), 'https://cloudbongos.com');
+  assert.equal(origin(''), null, 'no hub (a vanilla instance) → no row');
+  assert.equal(origin('http://cloudbongos.com'), null);
+  assert.equal(origin('https://cloudbongos.com/account'), null, 'a value with a path is not an origin');
+  assert.equal(origin('https://user@cloudbongos.com'), null);
+});

package/tests/idea_detail_page.mjs

@@ -400,5 +400,69 @@ await test('a failed mark re-enables the button rather than dead-ending', async
   assert.equal(r.markBtn().disabled, false);
 });
 
+// --- task 1004134: the author's scope recommendation is shown --------------
+//
+// A Full Idea carries its author's reading of how big it turned out (BV2.R13):
+// a goal of its own or a criterion inside an existing goal. The filing form
+// asked it and the idea read returned it, but this page never showed it, so
+// the board read a Full Idea without the one line written for them.
+// The question and the option labels come from the server (GET /inbox/template),
+// never from this page.
+const REC_SPEC = {
+  label: 'What do you think this is',
+  hint: 'Your reading of how big it turned out.',
+  required: false,
+  options: [{ value: 'goal', label: 'A goal of its own' }, { value: 'criterion', label: 'A criterion inside an existing goal' }],
+};
+const TEMPLATE_WITH_REC = { ...TEMPLATE, recommendation: REC_SPEC };
+
+await test('a Full Idea shows its author\'s recommendation, in the server\'s words (task 1004134)', async () => {
+  const r = render({ ...fullIdea, recommendation: 'criterion' }, { template: TEMPLATE_WITH_REC });
+  await settle();
+  const html = r.html();
+  assert.ok(html.includes('What do you think this is'), 'the question is on the page');
+  assert.ok(html.includes('a criterion inside an existing goal'), 'the chosen option, by its label');
+  assert.ok(!html.includes('a goal of its own'), 'and only the chosen one');
+  // the Board Room's own sentence for the same field (board-room.js), so the
+  // two pages cannot drift into two vocabularies
+  assert.ok(html.includes('Its author recommends this becomes <strong>a criterion inside an existing goal</strong>. The board decides.'));
+  // It is the author's reading, not the board's decision (spec decision 9).
+  assert.match(html, /author/i, 'the page says whose reading it is');
+});
+
+await test('a Full Idea filed with no recommendation says so, and invents none', async () => {
+  const r = render({ ...fullIdea, recommendation: null }, { template: TEMPLATE_WITH_REC });
+  await settle();
+  const html = r.html();
+  assert.ok(html.includes('What do you think this is'));
+  assert.ok(html.includes('Its author gave no scope recommendation.'), 'the absence is rendered honestly, in the Board Room\'s words');
+  assert.ok(!html.includes('a goal of its own') && !html.includes('a criterion inside'), 'no option is shown as picked');
+});
+
+await test('a value the served options do not name is printed, not dropped', async () => {
+  const r = render({ ...fullIdea, recommendation: 'epic' }, { template: TEMPLATE_WITH_REC });
+  await settle();
+  assert.ok(r.html().includes('epic'));
+});
+
+await test('the recommendation survives a template outage, as its stored value', async () => {
+  const r = render({ ...fullIdea, recommendation: 'goal' }, { templateFails: true });
+  await settle();
+  assert.ok(r.html().includes('goal'), 'the stored value is shown');
+});
+
+await test('a quick idea shows no recommendation line: it was never asked', async () => {
+  const r = render({ ...fullIdea, grade: 'quick', recommendation: null }, { template: TEMPLATE_WITH_REC });
+  await settle();
+  assert.ok(!r.html().includes('What do you think this is'));
+  assert.ok(!r.html().includes('Its author gave no scope recommendation.'));
+});
+
+await test('a recommendation cannot become markup', async () => {
+  const r = render({ ...fullIdea, recommendation: '<img src=x onerror=alert(1)>' }, { template: TEMPLATE_WITH_REC });
+  await settle();
+  assert.ok(!r.html().includes('<img src=x'), 'escaped');
+});
+
 console.log(`\nidea_detail_page: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/idea_goal_ratification.mjs

@@ -447,6 +447,70 @@ await test('a base-v1 Full Idea is refused, naming its vintage', async () => {
   assert.ok(!goalInsert());
 });
 
+// task 1004226 — the owner's decision (2026-09-29): when a Full Idea's template
+// asks no "what does success look like" question, the RATIFIER writes the
+// success criterion in the ratification request. Never derived from a v1 field.
+const V1_ANSWERS = Object.freeze({
+  purpose: 'the purpose, as the author wrote it',
+  big_picture: 'the big picture, as the author wrote it',
+  why_had: 'why they had it',
+  why_matters: 'why it matters',
+  fit: 'how it fits',
+});
+const RATIFIER_CRITERION = 'A builder can open the new page and see every idea they filed, newest first.';
+
+await test('a base-v1 Full Idea is ratified when the RATIFIER writes the success criterion (task 1004226)', async () => {
+  storedIdea = fullIdea({ template_key: 'base-v1', field_values: { ...V1_ANSWERS } });
+  const r = await drive(postRatifyGoal, { params: { id: '77' }, body: { ...OK_BODY, success_criterion: RATIFIER_CRITERION } });
+  assert.equal(r.status, 201, JSON.stringify(r.payload));
+  assert.equal(criterionInsert().params[2], RATIFIER_CRITERION, 'the done-when is the ratifier\'s words, verbatim');
+  assert.equal(r.payload.done_when_from, 'ratifier', 'the response says whose words the criterion is');
+  assert.ok(ideaUpdate() && auditInsert() && ran(/^COMMIT$/), 'the whole act still commits as one');
+});
+
+await test('the author\'s v1 answers all still reach the description, and the criterion is marked as the ratifier\'s', async () => {
+  storedIdea = fullIdea({ template_key: 'base-v1', field_values: { ...V1_ANSWERS } });
+  await drive(postRatifyGoal, { params: { id: '77' }, body: { ...OK_BODY, success_criterion: RATIFIER_CRITERION } });
+  const description = goalInsert().params[2];
+  for (const v of Object.values(V1_ANSWERS)) assert.ok(description.includes(v), `the author's answer "${v}" is rendered`);
+  assert.match(description, /written by the ratifier/i, 'a reader is told the done-when is not an answer of the author\'s');
+  // It is never presented AS an author answer: no heading carries it.
+  assert.ok(!/###[^\n]*\n\n[^\n]*A builder can open the new page/.test(description), 'the criterion is not rendered under an author question');
+});
+
+await test('a base-v1 Full Idea with NO ratifier criterion is still refused exactly as before', async () => {
+  storedIdea = fullIdea({ template_key: 'base-v1', field_values: { ...V1_ANSWERS } });
+  for (const body of [OK_BODY, { ...OK_BODY, success_criterion: '        ' }]) {
+    queries = [];
+    const r = await drive(postRatifyGoal, { params: { id: '77' }, body });
+    assert.equal(r.status, 400, JSON.stringify(body));
+    assert.equal(r.payload.reason, 'template_has_no_goal_shape');
+    assert.ok(!goalInsert(), 'nothing is created');
+  }
+});
+
+await test('a base-v2 Full Idea keeps the AUTHOR\'s success answer: a ratifier criterion is refused, not substituted', async () => {
+  const r = await drive(postRatifyGoal, { params: { id: '77' }, body: { ...OK_BODY, success_criterion: RATIFIER_CRITERION } });
+  assert.equal(r.status, 400, JSON.stringify(r.payload));
+  assert.equal(r.payload.reason, 'template_supplies_done_when');
+  assert.ok(!goalInsert(), 'nothing is created');
+  // and without one, v2 is exactly as it was
+  queries = [];
+  const ok = await drive(postRatifyGoal, { params: { id: '77' }, body: OK_BODY });
+  assert.equal(ok.status, 201);
+  assert.equal(criterionInsert().params[2], ANSWERS.success);
+  assert.equal(ok.payload.done_when_from, 'success');
+});
+
+await test('the ratifier criterion does not get past the board gate or the rank gates', async () => {
+  storedIdea = fullIdea({ template_key: 'base-v1', field_values: { ...V1_ANSWERS } });
+  boardPass = null;
+  const r = await drive(postRatifyGoal, { params: { id: '77' }, body: { ...OK_BODY, success_criterion: RATIFIER_CRITERION } });
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'BOARD_HAS_NOT_PASSED');
+  assert.ok(!goalInsert());
+});
+
 await test('a blank success answer is refused rather than made an empty criterion', async () => {
   // A goal whose only criterion is '' is one the close gate can never satisfy.
   storedIdea = fullIdea({ field_values: { ...ANSWERS, success: '   ' } });

package/tests/idea_spark_hall.mjs

@@ -59,7 +59,12 @@ const GOALS = [
 
 function boot({
   search = '', sparks = QUEUE, count = null, idea = SPARK, ideaOk = true, store = {},
-  versions = VERSIONS, goals = GOALS, suggestions = [],
+  versions = VERSIONS, goals = GOALS,
+  // The suggester's answer. An ARRAY is the same reply to every read; a
+  // FUNCTION of the request is how the out-of-order case below tells the two
+  // in-flight reads apart (task 1004187) — with one fixed array, a stale
+  // repaint and the right one render identically and nothing is pinned.
+  suggestions = [],
   // GRAVITY (task 1004083 / spec R02). The landing verdict the composer draws
   // its one line from. `null` means the read FAILED — distinct from a verdict of
   // `{ outcome: null }`, which is the server saying "nothing to state yet"; the
@@ -177,7 +182,7 @@ function boot({
     },
     goals: {
       getGoals: async () => { calls.push(['goals', null]); return { status: 200, ok: true, data: { goals } }; },
-      getGoalsSuggestions: gate('suggest', async (a) => { calls.push(['suggest', a]); return { status: 200, ok: true, data: { suggestions } }; }),
+      getGoalsSuggestions: gate('suggest', async (a) => { calls.push(['suggest', a]); return { status: 200, ok: true, data: { suggestions: typeof suggestions === 'function' ? suggestions(a) : suggestions } }; }),
     },
   };
 
@@ -781,12 +786,54 @@ await test('a slow preview answering after a faster one never repaints the stale
   assert.equal(r.el('fq-gravity').dataset.tone, 'lands');
 });
 
+await test('a slow goal suggestion answering after a faster one never repaints the stale options', async () => {
+  // The suggester's half of the same race (task 1004187). `refreshGravity` has
+  // carried `gravitySeq` since task 1004083; `refreshGoalSuggestions` carried
+  // only `goalTouchedByUser`, which answers a different question (has the
+  // builder picked manually?) and says nothing about ordering. Both are fired
+  // from the one debounce in `onQuickTitleEdit`, so a builder who keeps typing
+  // can have a slow read for words they have already replaced land LAST.
+  //
+  // The two reads must answer differently or there is nothing to pin, hence the
+  // function form of `suggestions`. Only the "Suggested" optgroup carries a
+  // `matched:` term — both goals appear in the browse-all half either way — so
+  // that is what the assertions read.
+  const r = boot({
+    defer: ['suggest'],
+    suggestions: (a) => (a.query.title === 'the widget is broken'
+      ? [{ id: '77', title: 'Goal Seventy Seven', score: 4, matched_terms: ['widget'] }]
+      : [{ id: '88', title: 'Another goal', score: 4, matched_terms: ['sprocket'] }]),
+  });
+  await settle(); await settle();
+
+  r.el('fq-title').value = 'the widget is broken';
+  r.el('fq-title')._handlers.input();
+  await new Promise((res) => setTimeout(res, 400));
+  r.el('fq-title').value = 'the sprocket is broken';
+  r.el('fq-title')._handlers.input();
+  await new Promise((res) => setTimeout(res, 400));
+
+  assert.equal(r.deferred.length, 2, 'both suggestion reads are in flight');
+  assert.equal(r.deferred[0].args[0].query.title, 'the widget is broken', 'the first asked about the title since replaced');
+  assert.equal(r.deferred[1].args[0].query.title, 'the sprocket is broken', 'the second asked about what is typed now');
+
+  r.deferred[1].release(); // the NEWER answer lands first
+  await settle(); await settle();
+  assert.match(r.el('fq-goal').innerHTML, /matched: sprocket/, "the current title's suggestion paints");
+
+  r.deferred[0].release(); // and now the older, slower one arrives
+  await settle(); await settle();
+  assert.match(r.el('fq-goal').innerHTML, /matched: sprocket/, 'the stale answer does not repaint the picker');
+  assert.doesNotMatch(r.el('fq-goal').innerHTML, /matched: widget/, 'suggestions for words already replaced never reach the builder');
+});
+
 // Every guard above was reverted and each redded its named case (RUN, and these
 // are the measured counts, not the predicted ones):
 //   drop renderGravity from the goal-change handler   -> 2 red (named-goal + filing-clears)
 //   infer from the select instead of the verdict      -> 4 red (both lies, + backlog + refusal)
 //   drop the seq guard and paint every answer         -> 1 red (the race case; task 1004108)
-//   make boot's `defer` never park (gate returns at once) -> 2 red (both race cases)
+//   drop goalSuggestSeq from refreshGoalSuggestions   -> 1 red (the suggester race; task 1004187)
+//   make boot's `defer` never park (gate returns at once) -> 3 red (all three race cases)
 //   rename the id in ideas.html                       -> 1 red (the markup pin ONLY)
 //
 // THE FIRST LINE COST A TEST FIX, and it is the reason to run these rather than
@@ -802,16 +849,20 @@ await test('a slow preview answering after a faster one never repaints the stale
 // previews could never overlap and deleting `if (seq !== gravitySeq) return;`
 // redded nothing — a green suite over a branch no case could enter. `boot({
 // defer: ['preview'] })` parks a named fake's answer until the test hands it
-// back, which makes the overlap real and the guard a tested property. The FOURTH
+// back, which makes the overlap real and the guard a tested property. The FIFTH
 // line above is the guard on the guard: if `defer` ever stops parking, the race
 // case would quietly go back to testing two sequential reads, so a case asserts
 // that both calls are in flight before the ordering is asserted at all.
 //
-// `getGoalsSuggestions` is gated the same way and for the same reason, but has
-// NO case yet: `refreshGoalSuggestions` carries no sequence guard — only
-// `goalTouchedByUser` — so a test of its ordering would red against the current
-// page rather than pin it. That is a production bug to file, not a test to
-// write, and the harness is now able to reach it the day it is fixed.
+// THE FOURTH LINE CLOSED THE BUG 1004108 LEFT STANDING. `getGoalsSuggestions`
+// was gated the same way and for the same reason but had NO case, because
+// `refreshGoalSuggestions` carried no sequence guard — only `goalTouchedByUser`
+// — so a test of its ordering would have redded against the page rather than
+// pinned it. Task 1004187 gave it `goalSuggestSeq`, and the day the guard
+// existed the harness could already reach it. The guard sits AFTER the catch
+// rather than only before the success render, so a read that fails late cannot
+// clear a newer read's options either; that is the shape `refreshGravity` has
+// always had, and it keeps both exits on ONE branch a single case can red.
 
 
 // --- the fold (task 1004087 / spec R04, decision 18) ----------------------