@bongos/core 1.19.1081 → 1.20.2

package/tests/grade_attempts.mjs

@@ -113,6 +113,67 @@ await test('gradeAttemptStats clamps the window (bad input → 7, oversize → 9
   assert.deepEqual(seen, [7, 7, 90, 90], 'both queries share the clamped window');
 });
 
+// ---- task 1004292: per-worker verdicts ride the attempt row ----
+
+const WORKERS = [
+  { kind: 'narc', verdict: 'pass', error: null, issues: [] },
+  { kind: 'hacker', verdict: 'concerns', error: null, issues: [{ severity: 'major', summary: 'SECRET PROSE', file: 'a.js' }, { severity: 'minor', summary: 'more prose' }] },
+  { kind: 'quality', verdict: 'fail', error: 'SUBAGENT_TIMEOUT', issues: [], stderr_tail: 'oops' },
+];
+
+await test('workerVerdicts keeps kind, verdict, error and severities and NOTHING else', () => {
+  const v = db.workerVerdicts(WORKERS);
+  assert.deepEqual(v[1], { kind: 'hacker', verdict: 'concerns', error: null, severities: ['major', 'minor'] });
+  assert.deepEqual(v[2], { kind: 'quality', verdict: 'fail', error: 'SUBAGENT_TIMEOUT', severities: [] });
+  const text = JSON.stringify(v);
+  assert.ok(!/PROSE|a\.js|oops|summary|stderr/.test(text), 'no prose, files or stderr');
+  assert.equal(db.workerVerdicts(undefined), null);
+  assert.equal(db.workerVerdicts([]), null);
+});
+
+await test('workerVerdicts caps the workers and severities it keeps', () => {
+  const many = Array.from({ length: db.VERDICT_LIMITS.workers + 5 }, (_, i) => ({ kind: `w${i}`, verdict: 'pass', issues: [] }));
+  assert.equal(db.workerVerdicts(many).length, db.VERDICT_LIMITS.workers);
+  const sev = [{ kind: 'x', verdict: 'fail', issues: Array.from({ length: db.VERDICT_LIMITS.severities + 9 }, () => ({ severity: 'minor' })) }];
+  assert.equal(db.workerVerdicts(sev)[0].severities.length, db.VERDICT_LIMITS.severities);
+});
+
+await test('logGradeAttempt writes worker_verdicts as one jsonb param', async () => {
+  const calls = [];
+  const r = await db.logGradeAttempt({ taskId: 9, builderId: 1, passed: false, score: 5, workers: WORKERS },
+    (text, params) => { calls.push({ text, params }); return Promise.resolve({ rows: [] }); });
+  assert.equal(r, true);
+  assert.equal(calls.length, 1);
+  assert.ok(/worker_verdicts/.test(calls[0].text));
+  assert.equal(calls[0].params.length, 5);
+  assert.equal(JSON.parse(calls[0].params[4])[1].kind, 'hacker');
+});
+
+await test('a failing worker_verdicts write never costs the attempt row (column not migrated)', async () => {
+  const calls = [];
+  const r = await db.logGradeAttempt({ taskId: 9, builderId: 1, passed: true, score: 8, workers: WORKERS },
+    (text) => {
+      calls.push(text);
+      if (/worker_verdicts/.test(text)) return Promise.reject(new Error('column "worker_verdicts" does not exist'));
+      return Promise.resolve({ rows: [] });
+    });
+  assert.equal(r, true, 'the plain row still lands');
+  assert.equal(calls.length, 2);
+  assert.ok(!/worker_verdicts/.test(calls[1]));
+  const both = await db.logGradeAttempt({ taskId: 9, passed: true, score: 8, workers: WORKERS }, () => { throw new Error('db down'); });
+  assert.equal(both, false, 'and a total failure still never throws');
+});
+
+await test('gradeAttemptVerdicts reads only rounds that kept verdicts, and never throws', async () => {
+  let sql;
+  const rows = await db.gradeAttemptVerdicts('12', (text, params) => { sql = { text, params }; return Promise.resolve({ rows: [{ passed: false, workers: [] }] }); });
+  assert.equal(rows.length, 1);
+  assert.ok(/worker_verdicts IS NOT NULL/.test(sql.text) && /ORDER BY attempted_at ASC/.test(sql.text));
+  assert.ok(sql.text.includes('LIMIT $2'), 'bounded to the most recent rounds');
+  assert.deepEqual(sql.params, [12, db.VERDICT_LIMITS.rounds]);
+  assert.deepEqual(await db.gradeAttemptVerdicts(12, () => Promise.reject(new Error('no column'))), []);
+});
+
 console.log('');
 console.log(`Grade-attempts (6D.6) tests: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/grade_attribution.mjs

@@ -114,4 +114,27 @@ await test('grade: NO claim on the task → falls back to the caller (never refu
   assert.equal(out.creditsAwarded, 0, 'still no per-task credit at grader-confirm (lands at ship)');
 });
 
+// task 1004292: applyGrade hands the panel's per-worker verdicts to the attempt
+// log (best-effort, post-commit), verdicts only — no prose.
+await test('grade: the attempt row carries the worker verdicts and no prose', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, task: TASK });
+  const seen = [];
+  const attemptQuery = (text, params) => { seen.push({ text, params }); return Promise.resolve({ rows: [] }); };
+  const grade = { ...passingGrade, signals: { workers: [
+    { kind: 'hacker', verdict: 'concerns', error: null, issues: [{ severity: 'major', summary: 'PROSE HERE' }] },
+  ] } };
+  await applyGrade({ taskId: TASK.id, builderId: ARCHON, gradeResult: grade }, { pool, attemptQuery });
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].text, /INSERT INTO grade_attempts .*worker_verdicts/);
+  assert.deepEqual(JSON.parse(seen[0].params[4]), [{ kind: 'hacker', verdict: 'concerns', error: null, severities: ['major'] }]);
+  assert.ok(!JSON.stringify(seen[0].params).includes('PROSE'));
+});
+
+await test('grade: a failing verdicts write never fails the grade', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, task: TASK });
+  const grade = { ...passingGrade, signals: { workers: [{ kind: 'hacker', verdict: 'pass', issues: [] }] } };
+  const out = await applyGrade({ taskId: TASK.id, builderId: ARCHON, gradeResult: grade }, { pool, attemptQuery: () => Promise.reject(new Error('boom')) });
+  assert.equal(out.taskStatus, 'confirmed');
+});
+
 summary();

package/tests/grade_correlation_audit.mjs

@@ -148,7 +148,7 @@ test('the CLI reports a saved dataset — refusals by name, and --json — with
   fs.writeFileSync(file, JSON.stringify({ grades: [row(1), row(2, { quality: 'fail' })], overrides: [] }));
   try {
     const text = execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file], { cwd: ROOT, encoding: 'utf8' });
-    assert.match(text, /2 recorded panel grade\(s\), minimum n = 30/);
+    assert.match(text, /2 recorded panel round\(s\) over 2 task\(s\), minimum n = 30/);
     assert.match(text, /narc × quality\s+REFUSED — n=2 is below the minimum of 30/);
     const json = JSON.parse(execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file, '--json'], { cwd: ROOT, encoding: 'utf8' }));
     assert.equal(json.panels, 2);
@@ -157,3 +157,56 @@ test('the CLI reports a saved dataset — refusals by name, and --json — with
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// ---- task 1004292: earlier rounds ----
+
+// A stored attempt: kind, verdict, error, severities. No prose.
+const AW = (kind, verdict, severities = [], error = null) => ({ kind, verdict, error, severities });
+const attempt = (o) => ({ attempted_at: '2026-09-29T00:00:00Z', passed: false, workers: [AW('narc', o.narc || 'pass'), AW('quality', o.quality || 'pass'), AW('hacker', o.hacker || 'pass', o.hs), AW('efficiency', o.efficiency || 'pass')] });
+const gradeOf = (attempts) => ({ passed: true, signals: { workers: [W('narc', 'pass'), W('quality', 'pass'), W('hacker', 'pass'), W('efficiency', 'pass')] }, attempts });
+
+test('a stored attempt votes from its severities alone', () => {
+  assert.equal(A.voteOf(AW('hacker', 'concerns', ['minor'])), 1);
+  assert.equal(A.voteOf(AW('hacker', 'pass')), 0);
+  assert.equal(A.voteOf(AW('hacker', 'fail', ['blocker'], 'parse_error')), 1, 'errored but substantive is still an objection');
+  assert.equal(A.voteOf(AW('hacker', 'fail', [], 'SUBAGENT_TIMEOUT')), null, 'errored with no finding casts none');
+});
+
+test('toAuditRow keeps every round that kept its verdicts; a task with none falls back to the final grade', () => {
+  const r = A.toAuditRow({ task_id: 5, task_status: 'shipped', grade: gradeOf([attempt({ hacker: 'concerns', hs: ['major'] }), attempt({})]) });
+  assert.equal(r.rounds.length, 2);
+  assert.equal(r.rounds[0].find((w) => w.kind === 'hacker').verdict, 'concerns');
+  assert.equal(JSON.stringify(r.rounds).includes('summary'), false, 'no prose travels with a round');
+  const legacy = A.toAuditRow({ task_id: 6, task_status: 'shipped', grade: gradeOf([]) });
+  assert.equal(legacy.rounds, undefined);
+  assert.equal(A.panelsOf(legacy).length, 1);
+});
+
+test('the audit counts earlier rounds: an objection fixed before the final grade is still a vote', () => {
+  // 40 tasks: round 1 the hacker and efficiency both object on half, round 2 (final) all clear.
+  const grades = Array.from({ length: 40 }, (_, i) => A.toAuditRow({
+    task_id: i, task_status: 'shipped',
+    grade: gradeOf([attempt({ hacker: i < 20 ? 'concerns' : 'pass', hs: ['major'], efficiency: i < 20 ? 'concerns' : 'pass' }), attempt({})]),
+  }));
+  const withRounds = A.audit({ grades, overrides: [] }, { minN: 30 });
+  assert.equal(withRounds.panels, 80);
+  assert.equal(withRounds.tasks, 40);
+  const he = withRounds.pairwise.find((p) => p.a === 'hacker' && p.b === 'efficiency');
+  assert.equal(he.refused, undefined, 'computable once earlier rounds are visible');
+  assert.equal(he.table.both_object, 20);
+  // The same tasks seen through their final grade alone: the objections are gone.
+  const finalOnly = A.audit({ grades: grades.map(({ rounds, ...g }) => g), overrides: [] }, { minN: 30 });
+  assert.notEqual(finalOnly.pairwise.find((p) => p.a === 'hacker' && p.b === 'efficiency').refused, undefined);
+});
+
+test('owner labels compare against the FINAL round only', () => {
+  const grades = Array.from({ length: 40 }, (_, i) => A.toAuditRow({
+    task_id: i, task_status: 'shipped',
+    // round 1 objects (quality), final clears; the owner accepted the final work.
+    grade: { ...gradeOf([attempt({ quality: 'concerns' }), attempt({})]), passed: false },
+  }));
+  const overrides = grades.map((g) => ({ task_id: g.task_id, status: 'approved' }));
+  const rep = A.audit({ grades, overrides }, { minN: 30 });
+  const q = rep.vs_owner.find((w) => w.kind === 'quality');
+  assert.equal(q.n, 40, 'one labelled observation per task, not per round');
+});

package/tests/grader_reader_lens.mjs

@@ -200,13 +200,66 @@ test('the prompt sends the worker to the written guide, and forbids an uncited f
   assert.match(p, /cites no rule id is not a finding/i, "the guide's own rule travels with it");
   // The hard/judgement split is what stops an advisory lens recording taste as
   // fact, so it is pinned rather than left to the prompt's good intentions.
-  assert.match(p, /V1-V5/, 'hard rules may be asserted');
-  assert.match(p, /V6-V11/, 'judgement rules may only be flagged');
+  // Read from the guide since task 1004075, so the pin is on what the guide
+  // says, not on a literal range the guide may outgrow.
+  const ids = reader.ruleIdsText(reader.voiceRuleClasses(fs.readFileSync(reader.VOICE_GUIDE, 'utf8')));
+  assert.ok(p.includes(`Hard rules (${ids.hard})`), 'hard rules may be asserted: ' + ids.hard);
+  assert.ok(p.includes(`Judgement rules (${ids.judgement})`), 'judgement rules may only be flagged: ' + ids.judgement);
   assert.match(p, /ADVISORY/, 'the worker is told it cannot block');
   assert.ok(!/blocker/.test(p.split('## Return ONLY JSON')[1] || ''),
     'the JSON schema offers no blocker severity');
 });
 
+// task 1004075: the guide grows by adding rules (its own Part D), so the lens
+// must follow the file rather than a range typed into the prompt.
+test('every rule id in docs/voice.md is a hard rule or a judgement rule, none left over', () => {
+  const text = fs.readFileSync(reader.VOICE_GUIDE, 'utf8');
+  const c = reader.voiceRuleClasses(text);
+  const all = [...text.matchAll(/^## (V\d+)\b/gm)].map((m) => m[1]);
+  assert.ok(all.length >= 11, 'the guide still carries its rules, saw ' + all.length);
+  assert.deepEqual(c.unclassified, [], 'a rule under neither Part A nor Part B reaches the lens unclassified');
+  assert.deepEqual([...c.hard, ...c.judgement].sort(), [...all].sort(), 'every rule is classified exactly once');
+  assert.ok(c.hard.length > 0 && c.judgement.length > 0, 'both classes are populated');
+});
+
+test('a twelfth rule, or a split rule, reaches the prompt with no change to reader.js', () => {
+  const text = fs.readFileSync(reader.VOICE_GUIDE, 'utf8');
+  const grown = text.replace(/\n# Part C/, '\n## V12 — A new judgement rule\n\nprose\n\n# Part C');
+  assert.notEqual(grown, text, 'fixture: Part C is still where the judgement rules end');
+  const c = reader.voiceRuleClasses(grown);
+  assert.ok(c.judgement.includes('V12'), 'the new rule is a judgement rule');
+  assert.equal(reader.ruleIdsText(c).judgement.endsWith('V12'), true, reader.ruleIdsText(c).judgement);
+  // splitting V4 renumbers: the ranges must follow whatever ids the file has
+  assert.equal(reader.formatRuleIds(['V1', 'V2', 'V3', 'V4', 'V5', 'V6']), 'V1-V6');
+  assert.equal(reader.formatRuleIds(['V7', 'V8', 'V10']), 'V7-V8, V10');
+});
+
+test('the PROMPT itself follows the guide: a grown guide reaches the header with no code change', () => {
+  // The unit checks above prove the parser; this proves the prompt uses it. A
+  // literal range typed back into the header would pass every other case today,
+  // because today's literal happens to match the guide. So load the worker
+  // against a guide with a V12 and read the header it builds.
+  const real = fs.readFileSync(reader.VOICE_GUIDE, 'utf8');
+  const grown = real.replace(/\n# Part C/, '\n## V12 — A new judgement rule\n\nprose\n\n# Part C');
+  const origRead = fs.readFileSync;
+  const key = require.resolve('../modules/grading/grader-workers/reader.js');
+  fs.readFileSync = function (p, ...rest) {
+    return String(p) === reader.VOICE_GUIDE ? grown : origRead.call(this, p, ...rest);
+  };
+  delete require.cache[key];
+  let fresh;
+  try { fresh = require(key); } finally { fs.readFileSync = origRead; delete require.cache[key]; require(key); }
+  assert.ok(fresh.PROMPT_HEADER.includes('Judgement rules (V6-V12)'), 'the header carries the grown judgement range');
+  assert.ok(fresh.PROMPT_HEADER.includes('Hard rules (V1-V5)'));
+});
+
+test('an unreadable guide makes the prompt name the Parts, never a stale number', () => {
+  const ids = reader.ruleIdsText(null);
+  assert.match(ids.hard, /Part A/);
+  assert.match(ids.judgement, /Part B/);
+  assert.ok(!/V\d/.test(ids.hard + ids.judgement));
+});
+
 test('docs/voice.md exists — the lens has a standard to judge against', () => {
   // The hard dependency (task 1003976). A copy lens with no written standard
   // records taste and calls it a finding.

package/tests/grader_root_outage.mjs

@@ -105,5 +105,10 @@ test('the worker spawn picks a permission mode the CLI accepts as root', () => {
   assert.match(src, /'--permission-mode', permissionMode/);
   assert.doesNotMatch(src, /'--permission-mode', 'bypassPermissions'/);
   // The tool list is what makes acceptEdits cost nothing: there are no edits.
-  assert.match(src, /'--tools', 'Read'/);
+  // task 1001691 gave every caller an opt-out (`opts.tools`, for the ADR 0101
+  // judge's zero-tools request), so the literal moved into a default rather
+  // than a hardcoded --tools argument — every OTHER caller still resolves to
+  // exactly 'Read', which is the property this test cares about.
+  assert.match(src, /opts\.tools \?\? 'Read'/);
+  assert.match(src, /'--tools', tools/);
 });

package/tests/grader_subagent_tools_arg.mjs

@@ -0,0 +1,102 @@
+// tests/grader_subagent_tools_arg.mjs — toolsArgForSpawn, the win32 empty-arg
+// fix behind runClaudeCli's `opts.tools` (task 1001691, round-4 hacker finding).
+//
+// THE BUG THIS PINS. runClaudeCli spawns with `shell: true` on win32 (the
+// claude.cmd shim needs it). Node's shell path on win32 joins argv into ONE
+// command-line string before handing it to cmd.exe, and an empty-string
+// element is silently DROPPED in that join — verified with a real spawn
+// during development (`node -e` reading back its own argv via a stub
+// script): `['--tools', '', '--strict-mcp-config']` arrived at the child as
+// `['--tools', '--strict-mcp-config']`, so `--tools` silently swallowed
+// `--strict-mcp-config` as its value — the opposite of "no tools", and it
+// would have reopened the exact MCP-server exposure task 1000380 closed.
+// `'""'` (two literal quote characters) is the standard Windows workaround:
+// cmd.exe's own argv parsing turns that back into a genuine empty string on
+// the far side — also verified with a real spawn before landing this file.
+//
+// Run: node tests/grader_subagent_tools_arg.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const subagent = require('../modules/grading/grader-subagent.js');
+const { toolsArgForSpawn } = subagent;
+
+const { test, summary } = makeRunner();
+
+await test('non-empty tools values pass through unchanged, on either platform', () => {
+  assert.equal(toolsArgForSpawn('Read', { shell: true }), 'Read');
+  assert.equal(toolsArgForSpawn('Read', { shell: false }), 'Read');
+  assert.equal(toolsArgForSpawn('Read,Write', { shell: true }), 'Read,Write');
+});
+
+await test('an empty request on a NON-shell spawn (POSIX) stays a plain empty string', () => {
+  assert.equal(toolsArgForSpawn('', { shell: false }), '', 'execve() gets the args array directly — no shell to interpret quoting');
+});
+
+await test('an empty request on a SHELL spawn (win32) is rewritten to the quoted-empty token', () => {
+  assert.equal(toolsArgForSpawn('', { shell: true }), '""', 'a bare empty string would be dropped by the shell join, shifting every later arg');
+});
+
+await test('the CLI-argv reconstruction: a bare "" survives Node\'s shell-join where a plain empty string does not', () => {
+  // The claim toolsArgForSpawn exists to make true, stated as a source fact
+  // (verified empirically during development with a real spawn — see this
+  // file's header) rather than re-run as a live child process on every CI
+  // machine, which would make this suite depend on a shell being present.
+  const rewritten = toolsArgForSpawn('', { shell: true });
+  assert.equal(rewritten.length, 2, 'exactly the two quote characters, nothing else');
+  assert.equal(rewritten, '"'.repeat(2));
+});
+
+// ---- REAL end-to-end: a genuine spawn through runSubagent -> runClaudeCli,
+// against a stub `claude` binary, on THIS host's real platform. The
+// grade_model_provider.mjs precedent stubs a shebang script and SKIPS on
+// win32 ("the fake CLI is a shebang script") — a shebang has no meaning to
+// cmd.exe. This stub is a `.cmd` file instead, which win32 spawns natively,
+// so this test runs WHERE THE BUG LIVED: on win32, through shell: true,
+// through the actual argv this module hands to cmd.exe — not a mock of
+// child_process, and not only the pure function above. ----
+
+await test('end-to-end: --tools "" arrives as a genuine empty string, and --strict-mcp-config is never swallowed as its value', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grader-tools-arg-'));
+  try {
+    let bin;
+    if (process.platform === 'win32') {
+      bin = path.join(dir, 'claude.cmd');
+      const echoJs = path.join(dir, 'echo.js');
+      fs.writeFileSync(echoJs,
+        "process.stdin.resume();\nprocess.stdin.on('end', () => process.stdout.write(JSON.stringify({ type: 'result', result: JSON.stringify(process.argv.slice(2)), total_cost_usd: 0 })));\n");
+      fs.writeFileSync(bin, `@echo off\r\nnode "${echoJs}" %*\r\n`);
+    } else {
+      bin = path.join(dir, 'claude');
+      fs.writeFileSync(bin,
+        '#!/usr/bin/env node\nprocess.stdin.resume(); process.stdin.on("end", () => process.stdout.write(JSON.stringify({ type: "result", result: JSON.stringify(process.argv.slice(2)), total_cost_usd: 0 })));\n');
+      fs.chmodSync(bin, 0o755);
+    }
+    // Self-quote `bin` on win32 (round-6 quality finding): shell:true joins
+    // [bin, ...args] with spaces before handing the line to cmd.exe, so an
+    // unquoted path containing a space (a real risk from a bare os.tmpdir())
+    // breaks exactly the same way the trap this file exists to test does —
+    // verified empirically (a real spawn against a deliberately spacey temp
+    // dir) that wrapping the executable path in quotes fixes it, mirroring
+    // how any real ops-configured CLAUDE_BIN with a space would also need
+    // quoting. Production's own default (`bin = 'claude'`, a bare PATH
+    // lookup) never hits this, so it stays out of runClaudeCli itself.
+    const claudeBin = process.platform === 'win32' ? `"${bin}"` : bin;
+    const r = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin, tools: '', model: 'claude-sonnet-5' } });
+    const argv = JSON.parse(subagent.extractAssistantResult(r.stdout));
+    const toolsIdx = argv.indexOf('--tools');
+    assert.ok(toolsIdx >= 0, '--tools made it into argv at all');
+    assert.equal(argv[toolsIdx + 1], '', 'the value right after --tools is a genuine empty string');
+    assert.ok(argv.includes('--strict-mcp-config'), '--strict-mcp-config is its own argv element, never swallowed as --tools\' value');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+summary();

package/tests/hall_approval_queue.mjs

@@ -101,9 +101,10 @@ function bootPanel({ answers = {}, writes = null, mode = 'light' } = {}) {
       return val.__status ? { ok: false, status: val.__status, data: val.data } : { ok: true, status: 200, data: val };
     },
   };
-  const win = { matchMedia: () => ({ matches: false }) };
+  const win = { matchMedia: () => ({ matches: false }), __BRANDING__: { identity: { productName: 'Cloud Bongos', worldName: 'the studio' } } };
   const ctx = vm.createContext({ window: win, document: documentObj, console, setTimeout, clearTimeout, encodeURIComponent });
   win.window = win;
+  vm.runInContext(read('brand-holes.js'), ctx, { filename: 'brand-holes.js' });
   vm.runInContext(read('approval-queue-lib.js'), ctx, { filename: 'approval-queue-lib.js' });
   vm.runInContext(read('approval-queue.js'), ctx, { filename: 'approval-queue.js' });
   const panel = win.OTBApprovalQueue.mount({
@@ -320,8 +321,59 @@ await test('the panel writes only through the writes it is handed; the studio ha
   assert.match(studio, /sendBack: \(pageId\) => `\$\{API\}\/copy-desk\/pages\/\$\{pageId\}\/send-back`,/);
   assert.match(studio, /writes: \{ approve: WRITE_ROUTES\.approve, sendBack: WRITE_ROUTES\.sendBack \}/);
   const html = read('studio.html');
-  assert.ok(html.indexOf('approval-queue-lib.js') < html.indexOf('approval-queue.js"') && html.indexOf('approval-queue.js"') < html.indexOf('studio.js?'), 'the lib, the panel, then the studio');
+  assert.ok(html.indexOf('brand-holes.js') < html.indexOf('approval-queue.js?') && html.indexOf('approval-queue-lib.js') < html.indexOf('approval-queue.js?') && html.indexOf('approval-queue.js?') < html.indexOf('studio.js?'), 'the holes and the lib, the panel, then the studio');
   assert.match(html, /id="studio-approvals"[^>]*aria-haspopup="dialog"/);
 });
 
+// ── task 1004381: brand holes read as the name, and the panel fits the screen ──
+
+await test('a line holding {{productName}} reads as the product name in a chip, in the line and in its was:', async () => {
+  const tasks = [round({
+    id: 43, pageId: 'landing:index', n: 2, appliedAt: '2026-09-21T00:00:00Z',
+    lines: [{ key: 'L0005', section: 'contact', before: 'Both are how {{productName}} itself works.', after: 'This project, {{productName}}, has two doors.' }],
+  })];
+  const b = bootPanel({ answers: { [APPROVALS]: queueFor({ tasks }), [vis(43)]: slotsFor(43) } });
+  await b.panel.open();
+  await settle(); await settle();
+  // The mini-DOM's textContent does not keep a text node's place between
+  // children, so the words are read in order off the painted markup.
+  const words = (open, close) => {
+    const h = b.q('.aq-dialog').innerHTML;
+    const at = h.indexOf(open);
+    assert.ok(at !== -1, `painted: ${open}`);
+    return h.slice(at + open.length, h.indexOf(close, at)).replace(/<[^>]+>/g, '');
+  };
+  const lineWords = () => words('<span class="aq-line__text">', '</span>\n');
+  const asideWords = () => words('<span class="aq-line__aside">', '</span>\n');
+  assert.equal(lineWords(), 'This project, Cloud Bongos, has two doors.');
+  assert.equal(asideWords(), 'was: Both are how Cloud Bongos itself works.');
+  const chips = b.qa('.aq-hole');
+  assert.equal(chips.length, 2, 'one chip in the line, one in its was:');
+  assert.ok(chips.every((c) => c.attrs['data-hole'] === 'productName' && text(c) === 'Cloud Bongos'));
+  assert.ok(b.q('mark').querySelector('.aq-hole'), 'the chip sits inside the changed words\' mark');
+  assert.ok(!/\{\{/.test(b.scrim.innerHTML || '') && !/\{\{/.test(text(b.scrim)), 'no raw {{token}} anywhere in the panel');
+  b.scrim.fire('click', { target: b.q('[data-phase="before"]') }); await settle();
+  assert.equal(lineWords(), 'Both are how Cloud Bongos itself works.');
+  assert.equal(asideWords(), 'becomes: This project, Cloud Bongos, has two doors.');
+});
+
+await test('the dialog fits the viewport at every width: capped by the screen, the page shrinks first, rows wrap', () => {
+  const css = read('approval-queue.css');
+  const rule = (sel) => {
+    const at = css.indexOf(`\n${sel} {`);
+    assert.ok(at !== -1, `a ${sel} rule`);
+    return css.slice(at, css.indexOf('}', at));
+  };
+  const dialog = rule('.aq-dialog');
+  assert.match(dialog, /width: min\(1180px, 100%, calc\(100vw - 48px\)\)/, 'never wider than the screen less its gutters');
+  assert.match(dialog, /height: min\(820px, 100%, calc\(100dvh - 48px\)\)/, 'never taller than the screen');
+  assert.match(dialog, /min-width: 0/);
+  assert.match(rule('.aq-head'), /flex-wrap: wrap/, 'the header wraps rather than running off the edge');
+  assert.match(rule('.aq-foot'), /flex-wrap: wrap/);
+  assert.match(rule('.aq-body'), /min-width: 0/);
+  assert.match(rule('.aq-frame'), /flex-grow: 1;[\s\S]*min-width: 0/, 'the rendered page is what shrinks first');
+  assert.match(rule('.aq-lines'), /width: clamp\(240px, 32%, 300px\)/, 'the words keep the artboard\'s 300 until the page has shrunk');
+  assert.match(rule('.aq-line__text'), /overflow-wrap: anywhere/, 'a long word breaks inside its column');
+});
+
 summary();

package/tests/hall_settings_world.mjs

@@ -133,7 +133,9 @@ test('a toggle is a role=switch with aria-checked, and the page script keeps dat
   // toggle in task 1002518 (four rungs, not on/off), so it became a radio group
   // in settings-render.js — covered by the radio assertions and the wiring test
   // below, not by the switch contract.
-  for (const fnName of ['renderSounds', 'renderCrossProject', 'privacyRow']) {
+  // renderCrossProject and privacyRow left with their sections (task 1004259):
+  // the hub's account page owns those settings now, and the hall links out.
+  for (const fnName of ['renderSounds']) {
     const body = settingsJs.match(new RegExp(`function ${fnName}\\([\\s\\S]*?\\n  \\}\\n`));
     assert.ok(body && /switchHtml\(/.test(body[0]), `${fnName} renders the switch`);
   }