@bongos/core 1.19.1081 → 1.20.2

package/tests/speciality_skills.mjs

@@ -0,0 +1,214 @@
+// tests/speciality_skills.mjs — a speciality OFFERS skills; each adopter's
+// ENABLED set starts empty and holds only offered skills this instance has
+// (task 1004072, part 1 of 3 of ADR 0310).
+//
+// Three altitudes: the disk reader against a temp tree, the pure rules, and the
+// real routes/specialities.js router with the db functions stubbed at the
+// module boundary, so the wiring (which set is checked where) is exercised and
+// not only the rule.
+//
+// Run:  node tests/speciality_skills.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const S = require('../modules/specialities/specialities.js');
+const skills = require('../modules/specialities/skills.js');
+const db = require('../modules/specialities/db.js');
+const api = require('../src/module-api.js');
+const { test, summary } = makeRunner();
+
+// ---- 1. the skills this instance has, read from disk -----------------------
+function tree() {
+  const t = fs.mkdtempSync(path.join(os.tmpdir(), 'spec-skills-'));
+  const put = (rel, body) => { const p = path.join(t, rel); fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, body); };
+  put('core/.claude/skills/recall/SKILL.md', '---\nname: recall\ndescription: Search what the project already knows.\n---\nbody');
+  put('core/.claude/skills/status/SKILL.md', '---\ndescription: "Roll up a version."\n---\n');
+  put('core/.claude/skills/not-a-skill/README.md', 'no SKILL.md here');
+  put('core/.claude/skills/Bad_Name/SKILL.md', '---\ndescription: x\n---\n');
+  put('inst/.claude/skills/house-style/SKILL.md', '---\ndescription: The instance\'s own.\n---\n');
+  put('core/modules/on-mod/skills/costing/SKILL.md', '---\ndescription: Price a thing.\n---\n');
+  put('core/modules/off-mod/skills/secret/SKILL.md', '---\ndescription: Disabled module.\n---\n');
+  return t;
+}
+
+await test('the instance\'s skills are the core\'s, the instance\'s and ENABLED modules\' — nothing else', () => {
+  const t = tree();
+  try {
+    const got = skills.installedSkills({ coreRoot: path.join(t, 'core'), instanceRoot: path.join(t, 'inst'), isModuleEnabled: (k) => k === 'on-mod' });
+    assert.deepEqual([...got.keys()].sort(), ['costing', 'house-style', 'recall', 'status']);
+    assert.equal(got.get('recall').description, 'Search what the project already knows.');
+    assert.equal(got.get('status').description, 'Roll up a version.', 'a quoted description is unquoted');
+    assert.equal(got.get('costing').source, 'module:on-mod');
+    assert.ok(!got.has('secret'), 'a disabled module\'s skill is not this instance\'s');
+    assert.ok(!got.has('not-a-skill'), 'a directory with no SKILL.md is not a skill');
+  } finally { fs.rmSync(t, { recursive: true, force: true }); }
+});
+
+await test('the real tree resolves: the core ships skills a speciality can offer', () => {
+  const got = skills.installedSkills({ coreRoot: ROOT, isModuleEnabled: () => false });
+  assert.ok(got.has('recall') && got.has('status'), 'core skills are found in this checkout');
+});
+
+await test('an unreadable root contributes nothing rather than throwing', () => {
+  const got = skills.installedSkills({ coreRoot: path.join(os.tmpdir(), 'no-such-root-' + Date.now()), isModuleEnabled: () => { throw new Error('boom'); } });
+  assert.equal(got.size, 0);
+});
+
+// ---- 2. the pure rules ------------------------------------------------------
+const INSTALLED = new Set(['recall', 'status', 'costing']);
+const draft = (over = {}) => ({ name: 'Economics', discipline: 'ideator', owner_kind: 'builder', owner_builder_id: 1, ...over });
+const codes = (r) => r.errors.map((e) => e.code);
+
+await test('a speciality may offer skills this instance has', () => {
+  const r = S.validateDraft(draft({ skills: ['recall', 'costing'] }), { disciplines: ['ideator'], installedSkills: INSTALLED });
+  assert.equal(r.ok, true, JSON.stringify(r.errors));
+});
+
+await test('a skill this instance does NOT have is refused, by name', () => {
+  const r = S.validateDraft(draft({ skills: ['recall', 'teleport'] }), { disciplines: ['ideator'], installedSkills: INSTALLED });
+  assert.equal(r.ok, false);
+  const e = r.errors.find((x) => x.code === 'unknown_skill');
+  assert.ok(e, JSON.stringify(r.errors));
+  assert.deepEqual(e.names, ['teleport']);
+});
+
+await test('a non-empty offered set nothing could check is refused, never admitted', () => {
+  const r = S.validateDraft(draft({ skills: ['recall'] }), { disciplines: ['ideator'] });
+  assert.ok(codes(r).includes('uncheckable'));
+  // and an empty set needs no check
+  assert.equal(S.validateDraft(draft({ skills: [] }), { disciplines: ['ideator'] }).ok, true);
+});
+
+await test('shape: not a list, a bad name, a duplicate, too many', () => {
+  const v = (skillsList) => codes(S.validateDraft(draft({ skills: skillsList }), { disciplines: ['ideator'], installedSkills: INSTALLED }));
+  assert.ok(v('recall').includes('invalid'));
+  assert.ok(v(['Recall']).includes('invalid_name'));
+  assert.ok(v(['recall', 'recall']).includes('duplicate'));
+  const many = Array.from({ length: S.LIMITS.SKILLS + 1 }, (_, i) => `s${i}`);
+  assert.ok(v(many).includes('too_many'));
+});
+
+await test('an adopter may enable only skills the speciality OFFERS and the instance HAS', () => {
+  const sp = { skills: ['recall', 'status'] };
+  assert.deepEqual(S.enabledSkillsErrors(['recall'], sp, INSTALLED), []);
+  assert.deepEqual(S.enabledSkillsErrors([], sp, INSTALLED), [], 'turning everything off is a legal choice');
+  const notOffered = S.enabledSkillsErrors(['costing'], sp, INSTALLED);
+  assert.ok(notOffered.some((e) => e.code === 'not_offered' && e.names.includes('costing')), 'installed but not offered');
+  const gone = S.enabledSkillsErrors(['recall'], { skills: ['recall'] }, new Set(['status']));
+  assert.ok(gone.some((e) => e.code === 'unknown_skill'), 'offered but removed from the instance since');
+});
+
+// ---- 3. the storage: a NEW adoption's enabled set is EMPTY, as stored --------
+await test('the migration stores an EMPTY enabled set by default, not a UI default', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/specialities/migrations/specialities_003_skills.sql'), 'utf8');
+  const ddl = sql.split('\n').filter((l) => !/^\s*--/.test(l)).join('\n');
+  assert.match(ddl, /ALTER TABLE specialities_adoptions\s+ADD COLUMN IF NOT EXISTS enabled_skills TEXT\[\] NOT NULL DEFAULT '\{\}'/);
+  assert.match(ddl, /ALTER TABLE specialities_catalog\s+ADD COLUMN IF NOT EXISTS skills TEXT\[\] NOT NULL DEFAULT '\{\}'/);
+  assert.ok(!/\bDROP (TABLE|COLUMN)\b/i.test(ddl), 'additive');
+});
+
+await test('adopting never writes the enabled set, so every new adoption takes the empty default', async () => {
+  const seen = [];
+  const exec = async (text, params) => { seen.push({ text, params }); return { rows: [{ builder_id: 1, speciality_id: 9, enabled_skills: [] }], rowCount: 1 }; };
+  const row = await db.adopt({ builderId: 1, specialityId: 9, discipline: 'ideator' }, exec);
+  const insert = seen.find((q) => /INSERT INTO specialities_adoptions/.test(q.text));
+  assert.ok(insert, 'the adopt INSERT ran');
+  assert.ok(!/enabled_skills\s*[,)]/.test(insert.text.split('VALUES')[0]), 'the INSERT column list does not name enabled_skills');
+  assert.ok(!/DO UPDATE SET((?!RETURNING)[\s\S])*enabled_skills/.test(insert.text), 're-adopting does not overwrite a person\'s earlier choices either');
+  assert.deepEqual(row.enabled_skills, []);
+});
+
+await test('the enabled set is written only on the caller\'s own ACTIVE adoption', async () => {
+  let q;
+  const exec = async (text, params) => { q = { text, params }; return { rows: [], rowCount: 0 }; };
+  const r = await db.setEnabledSkills(1, 9, ['recall'], exec);
+  assert.equal(r, null, 'no active adoption, nothing written');
+  assert.match(q.text, /WHERE builder_id = \$1 AND speciality_id = \$2 AND active/);
+  assert.deepEqual(q.params, [1, 9, ['recall']]);
+});
+
+// ---- 4. the real router -----------------------------------------------------
+const store = {
+  speciality: { id: 9, name: 'Economics', discipline: 'ideator', owner_kind: 'builder', owner_builder_id: 1, visibility: 'public', sellable: false, skills: ['recall', 'status'] },
+  adoption: null, created: null, updated: null,
+};
+db.getSpeciality = async () => ({ ...store.speciality });
+db.setEnabledSkills = async (b, s, list) => (store.adoption ? { ...store.adoption, enabled_skills: list } : null);
+db.createSpeciality = async (row) => { store.created = row; return { id: 10, ...row }; };
+db.updateSpeciality = async (id, patch) => { store.updated = patch; return { ...store.speciality, ...patch }; };
+db.countTraining = async () => ({ documentCount: 0, learningCount: 0 });
+skills.installedSkillsCached = () => new Map([['recall', {}], ['status', {}], ['costing', {}]]);
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'metic' }; next(); };
+api.enabledDisciplines = () => ['ideator', 'engineer', 'artist'];
+
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => { res.fail = (code, st, extra) => res.status(typeof st === 'number' ? st : (st && st.status) || 500).json({ error: code, ...(st && typeof st === 'object' ? st : {}), ...(extra || {}) }); next(); });
+app.use(require('../modules/specialities/routes/specialities.js')());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const call = async (method, url, body) => {
+  const r = await fetch(base + url, { method, headers: { 'Content-Type': 'application/json' }, body: body ? JSON.stringify(body) : undefined });
+  return { status: r.status, body: await r.json() };
+};
+
+try {
+  await test('POST /specialities stores an offered set of installed skills', async () => {
+    const r = await call('POST', '/specialities', { name: 'Economics', discipline: 'ideator', skills: ['recall', 'costing'] });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.deepEqual(store.created.skills, ['recall', 'costing']);
+  });
+
+  await test('POST /specialities refuses a skill the instance does not have', async () => {
+    store.created = null;
+    const r = await call('POST', '/specialities', { name: 'Econ2', discipline: 'ideator', skills: ['teleport'] });
+    assert.equal(r.status, 400);
+    assert.ok(JSON.stringify(r.body).includes('unknown_skill'));
+    assert.equal(store.created, null, 'nothing was written');
+  });
+
+  await test('PATCH that does not send skills is not blocked by a skill removed since', async () => {
+    store.speciality.skills = ['recall', 'gone-now'];
+    const r = await call('PATCH', '/specialities/9', { name: 'Economics renamed' });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    const bad = await call('PATCH', '/specialities/9', { skills: ['recall', 'gone-now'] });
+    assert.equal(bad.status, 400, 'but sending a list is held to what exists now');
+    store.speciality.skills = ['recall', 'status'];
+  });
+
+  await test('PUT /specialities/:id/skills needs an active adoption', async () => {
+    store.adoption = null;
+    const r = await call('PUT', '/specialities/9/skills', { enabled_skills: ['recall'] });
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error, 'not_adopted');
+  });
+
+  await test('PUT /specialities/:id/skills stores offered, installed skills, and refuses others', async () => {
+    store.adoption = { builder_id: 1, speciality_id: 9, active: true, enabled_skills: [] };
+    const ok = await call('PUT', '/specialities/9/skills', { enabled_skills: ['status'] });
+    assert.equal(ok.status, 200, JSON.stringify(ok.body));
+    assert.deepEqual(ok.body.adoption.enabled_skills, ['status']);
+    const off = await call('PUT', '/specialities/9/skills', { enabled_skills: [] });
+    assert.equal(off.status, 200, 'everything off is a choice');
+    const notOffered = await call('PUT', '/specialities/9/skills', { enabled_skills: ['costing'] });
+    assert.equal(notOffered.status, 400);
+    assert.ok(JSON.stringify(notOffered.body).includes('not_offered'));
+    const missing = await call('PUT', '/specialities/9/skills', {});
+    assert.equal(missing.status, 400, 'the set is required: a PUT replaces it whole');
+  });
+} finally {
+  await new Promise((r) => server.close(r));
+}
+
+summary();

package/tests/studio_room_height.mjs

@@ -0,0 +1,70 @@
+// tests/studio_room_height.mjs — the studio's night room stays composed on a tall
+// screen (task 1004344).
+//
+// The room is laid out on the artboard's ~900px height: the window at 86px, the
+// floor from 700px, the desk objects just above it. On a taller screen every
+// piece kept those tops, so the scene sat in the top 700px and the rest of the
+// screen was bare floor, which read as a blank strip at the bottom (544px of it
+// at 1300 tall). The fix moves the WHOLE scene down by half the height beyond
+// the artboard, one variable, so it stays centred and keeps its own proportions.
+// The phone layout anchors the desk to the bottom already and must not move.
+//
+// Run:  node tests/studio_room_height.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const CSS = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'studio.css'), 'utf8');
+const { test, summary } = makeRunner();
+
+// The sheet up to the phone block: the desktop room.
+const phoneAt = CSS.indexOf('@media (max-width: 760px)');
+assert.ok(phoneAt > 0, 'the phone block is still where the room is re-laid for a phone');
+const DESKTOP = CSS.slice(0, phoneAt);
+const PHONE = CSS.slice(phoneAt, CSS.indexOf('\n}\n', phoneAt));
+
+const ruleOf = (sheet, sel) => {
+  const esc = sel.replace(/[.*+?^${}()|[\]\\-]/g, '\\$&');
+  const m = new RegExp(`(^|\\n)${esc} \\{([^}]*)\\}`).exec(sheet);
+  return m ? m[2] : null;
+};
+
+// Every piece of the room that is placed by a pixel `top`.
+const PIECES = ['.st-window', '.st-floor', '.st-glow', '.st-lamp-stem', '.st-lamp-shade', '.st-mug', '.st-leaf--1', '.st-leaf--2'];
+
+await test('the room declares one drop: half the height beyond the 900px artboard, never negative', () => {
+  const room = ruleOf(DESKTOP, '.st-room');
+  assert.ok(room, 'the .st-room rule');
+  assert.match(room, /--room-drop: max\(0px, calc\(\(100% - 900px\) \/ 2\)\);/);
+});
+
+await test('every piece of the scene moves by that drop, so it moves as ONE picture', () => {
+  for (const sel of PIECES) {
+    const rule = ruleOf(DESKTOP, sel);
+    assert.ok(rule, `the ${sel} rule`);
+    const top = /(?:^|[\s;])top: ([^;]+);/.exec(rule);
+    assert.ok(top, `${sel} is placed by a top`);
+    assert.match(top[1], /var\(--room-drop\)/, `${sel} top moves with the room: ${top[1]}`);
+  }
+});
+
+await test('the drop keeps the original tops: at the artboard height the room is exactly where it was', () => {
+  // calc(Npx + var(--room-drop)) with the drop at 0px is Npx: the tops the
+  // design of record placed. Pinned by value so a refactor cannot move them.
+  const expected = { '.st-window': 86, '.st-floor': 700, '.st-glow': 470, '.st-lamp-stem': 560, '.st-lamp-shade': 540, '.st-mug': 650, '.st-leaf--1': 610, '.st-leaf--2': 590 };
+  for (const [sel, px] of Object.entries(expected)) {
+    const top = /(?:^|[\s;])top: calc\((\d+)px \+ var\(--room-drop\)\);/.exec(ruleOf(DESKTOP, sel));
+    assert.ok(top, `${sel} top is calc(<px> + var(--room-drop))`);
+    assert.equal(Number(top[1]), px, `${sel} keeps its design top`);
+  }
+});
+
+await test('the phone room does not move: the drop is zero there', () => {
+  assert.match(PHONE, /\.st-room \{ --room-drop: 0px; \}/, 'the phone block zeroes the drop');
+});
+
+summary();

package/tests/task_detail_includes.mjs

@@ -106,3 +106,13 @@ test('an empty ledger is an empty array, never null — the page tells "none" fr
     assert.deepEqual(await reads.getTaskClaims(1), []);
   });
 });
+
+// ---- task 1004292: ?include=grade carries every round's per-worker verdicts ----
+
+test('?include=grade,grade_attempts serves grade.attempts; the read runs only when asked, inside the Promise.all', () => {
+  for (const frag of ["includes.includes('grade_attempts')", 'wantAttempts ? db.gradeAttemptVerdicts(id) : Promise.resolve(null)', 'if (wantAttempts && body.grade) body.grade = { ...body.grade, attempts }']) {
+    assert.ok(handler.includes(frag), `handler has: ${frag}`);
+  }
+  const db = require('../modules/lifecycle/db.js');
+  assert.equal(typeof db.gradeAttemptVerdicts, 'function');
+});

package/tests/task_visuals_instance_root.mjs

@@ -0,0 +1,150 @@
+// tests/task_visuals_instance_root.mjs
+//
+// Task 1004381: task visuals must be stored under the INSTANCE root, never inside
+// the installed core package, so they survive a core upgrade.
+//
+// The live failure: in the consumer layout the core runs from
+// node_modules/@bongos/core, and visualsDir() resolved from __dirname, so every
+// render was written into the package and erased by the next upgrade.
+//
+// This builds a real consumer tree in a temp dir: a fake installed core package
+// carrying the REAL task-visuals.js plus a doorway stub that re-exports the real
+// resolveInstanceRoot, then proves, through that installed copy:
+//   1. the store is the instance's var/task-visuals, not inside the package;
+//   2. a stored visual survives the package being deleted and reinstalled;
+//   3. the boot move carries files from the old in-package path, once, without
+//      overwriting, and is a no-op in a single checkout or under an override;
+//   4. the store keeps the instance's git tree clean (upgrade pre-flight).
+//
+// Run:  node tests/task_visuals_instance_root.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const REAL_LIB = path.join(REPO, 'modules', 'lifecycle', 'task-visuals.js');
+const REAL_IC = path.join(REPO, 'src', 'instance-config.js');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e && e.stack ? e.stack.split('\n').slice(0, 3).join('\n        ') : e}`); }
+}
+
+const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex');
+
+const WORK = fs.mkdtempSync(path.join(os.tmpdir(), 'tv-instance-root-'));
+const CONSUMER = path.join(WORK, 'consumer');
+const CORE = path.join(CONSUMER, 'node_modules', '@bongos', 'core');
+
+// "npm ci": (re)install the fake core package — the real lib, and a doorway stub.
+function installCore() {
+  fs.rmSync(CORE, { recursive: true, force: true });
+  fs.mkdirSync(path.join(CORE, 'modules', 'lifecycle'), { recursive: true });
+  fs.mkdirSync(path.join(CORE, 'src'), { recursive: true });
+  fs.copyFileSync(REAL_LIB, path.join(CORE, 'modules', 'lifecycle', 'task-visuals.js'));
+  fs.writeFileSync(path.join(CORE, 'src', 'module-api.js'),
+    `module.exports = { resolveInstanceRoot: require(${JSON.stringify(REAL_IC)}).resolveInstanceRoot };\n`);
+}
+// A fresh require of the INSTALLED copy (a restarted server).
+function loadInstalled() {
+  const p = path.join(CORE, 'modules', 'lifecycle', 'task-visuals.js');
+  delete require.cache[p];
+  return require(p);
+}
+const inside = (child, parent) => {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+};
+
+fs.mkdirSync(CONSUMER, { recursive: true });
+installCore();
+delete process.env.TASK_VISUALS_DIR;
+process.env.BONGOS_INSTANCE_ROOT = CONSUMER;
+
+await t('consumer layout: the store is <instance>/var/task-visuals, NOT inside the core package', () => {
+  const tv = loadInstalled();
+  const dir = tv.visualsDir();
+  assert.equal(path.resolve(dir), path.join(CONSUMER, 'var', 'task-visuals'));
+  assert.ok(!inside(dir, CORE), `store ${dir} is inside the core package ${CORE}`);
+});
+
+await t('TASK_VISUALS_DIR still overrides', () => {
+  const tv = loadInstalled();
+  assert.equal(tv.visualsDirFor({ env: { TASK_VISUALS_DIR: '/elsewhere/x' } }), '/elsewhere/x');
+});
+
+let storedName;
+await t('a stored visual survives a core upgrade (package deleted and reinstalled)', async () => {
+  const tv = loadInstalled();
+  const r = await tv.persistImageBuffer(PNG, { taskId: 1004381, contentType: 'image/png' });
+  assert.equal(r.ok, true);
+  storedName = r.file;
+  installCore(); // the upgrade
+  const after = loadInstalled();
+  const p = after.resolveSafe(storedName);
+  assert.ok(p && fs.existsSync(p), 'the visual is gone after the upgrade');
+  assert.deepEqual(fs.readFileSync(p), PNG);
+});
+
+await t('the default store carries a * .gitignore, so the instance git tree stays clean', () => {
+  const gi = fs.readFileSync(path.join(CONSUMER, 'var', 'task-visuals', '.gitignore'), 'utf8');
+  assert.match(gi, /^\*$/m);
+  const init = spawnSync('git', ['init', '-q'], { cwd: CONSUMER, encoding: 'utf8' });
+  if (init.status !== 0) { console.log('        (git unavailable: .gitignore content checked only)'); return; }
+  fs.writeFileSync(path.join(CONSUMER, '.gitignore'), 'node_modules/\n');
+  const st = spawnSync('git', ['status', '--porcelain', '--untracked-files=all', '--', 'var'], { cwd: CONSUMER, encoding: 'utf8' });
+  assert.equal(st.status, 0);
+  assert.equal(st.stdout.trim(), '', `var/ shows in git status:\n${st.stdout}`);
+});
+
+await t('boot move: files at the old in-package path move into the instance store, once', async () => {
+  const tv = loadInstalled();
+  const legacy = path.join(CORE, 'var', 'task-visuals');
+  fs.mkdirSync(legacy, { recursive: true });
+  const a = 'task-1004345-0123456789abcdef.png';
+  const b = 'task-1004347-fedcba9876543210.png';
+  fs.writeFileSync(path.join(legacy, a), PNG);
+  fs.writeFileSync(path.join(legacy, b), Buffer.from('legacy copy'));
+  fs.writeFileSync(path.join(legacy, 'not-a-visual.txt'), 'x');
+  // b already exists in the new store: it must be kept, not overwritten.
+  const store = tv.visualsDir();
+  fs.writeFileSync(path.join(store, b), PNG);
+
+  const r = await tv.migrateLegacyVisuals();
+  assert.deepEqual(r, { moved: 1, skipped: 1, failed: 0 });
+  assert.deepEqual(fs.readFileSync(path.join(store, a)), PNG);
+  assert.ok(!fs.existsSync(path.join(legacy, a)), 'the moved file is still in the package');
+  assert.deepEqual(fs.readFileSync(path.join(store, b)), PNG, 'an existing file was overwritten');
+  assert.ok(fs.existsSync(path.join(legacy, 'not-a-visual.txt')), 'a foreign file was touched');
+
+  const again = await tv.migrateLegacyVisuals();
+  assert.deepEqual(again, { moved: 0, skipped: 1, failed: 0 });
+});
+
+await t('boot move is a no-op in a single checkout (same dir) and under TASK_VISUALS_DIR', async () => {
+  const tv = loadInstalled();
+  const same = path.join(WORK, 'same');
+  fs.mkdirSync(same, { recursive: true });
+  fs.writeFileSync(path.join(same, 'task-1-0123456789abcdef.png'), PNG);
+  assert.deepEqual(await tv.migrateLegacyVisuals({ from: same, to: same }), { moved: 0, skipped: 0, failed: 0 });
+  assert.deepEqual(await tv.migrateLegacyVisuals({ env: { TASK_VISUALS_DIR: path.join(WORK, 'o') } }), { moved: 0, skipped: 0, failed: 0 });
+  assert.deepEqual(await tv.migrateLegacyVisuals({ from: path.join(WORK, 'absent') }), { moved: 0, skipped: 0, failed: 0 });
+});
+
+await t('the served lib in THIS checkout resolves from the instance root, not __dirname', () => {
+  const src = fs.readFileSync(REAL_LIB, 'utf8');
+  const fn = src.slice(src.indexOf('function visualsDirFor'), src.indexOf('function visualsDir()'));
+  assert.match(fn, /instanceRoot\(\)/);
+  assert.doesNotMatch(fn, /__dirname/);
+});
+
+fs.rmSync(WORK, { recursive: true, force: true });
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/tweak_batch_apply.mjs

@@ -95,6 +95,27 @@ await test('a multi-line batch applies every line, across files, holes put back'
   assert.ok(!out.sources.has(OTHER), 'the same sentence in ANOTHER file is left alone: the line names its own file');
 });
 
+await test('a {{token}} brand hole is written back verbatim, and a rewrite that drops or adds one is refused (task 1004381)', () => {
+  const rel = 'modules/public-landing/public/fixture-contact.html';
+  const tree = { [rel]: '<!doctype html>\n<html><body>\n<p>Both are how {{productName}} itself works.</p>\n</body></html>\n' };
+  const rows = ci.fromHtml({ source: tree[rel], rel }).map(({ start, end, ...r }) => ({ id: ci.stableId('landing', r.text), surface: 'landing', ...r }));
+  const reg = { entries: rows, counts: { strings: rows.length } };
+  const r = rows.find((e) => e.text === 'Both are how {{productName}} itself works.');
+  assert.ok(r, 'the registry keeps the token by name');
+  const mk = (key, after) => ({ key, section: 'contact', before: r.text, after, placement: 'placed', file: rel, line: r.line, string_id: r.id });
+  const batch = (lines) => ({ page_id: 'landing:contact', reading_hash: 'h', submitted_at: '2026-09-29T00:00:00Z', lines });
+
+  const kept = apply.applyBatchToSources({ batch: batch([mk('L0001', 'This project, {{productName}}, has two doors.')]), registry: reg, readSource: readerOf(tree) });
+  assert.deepEqual(kept.refused, []);
+  assert.match(kept.sources.get(rel), /<p>This project, \{\{productName\}\}, has two doors\.<\/p>/, 'the token, and the spaces around it, land in the source as typed');
+  assert.doesNotMatch(kept.sources.get(rel), /Cloud Bongos/, 'no brand value is baked into the source');
+
+  for (const [key, after] of [['L0002', 'This project, Cloud Bongos, has two doors.'], ['L0003', '{{productName}} and {{productName}} again.']]) {
+    const out = apply.applyBatchToSources({ batch: batch([mk(key, after)]), registry: reg, readSource: readerOf(tree) });
+    assert.deepEqual(out.refused.map((x) => [x.key, x.code]), [[key, 'placeholder_mismatch']], `${after} is refused`);
+  }
+});
+
 await test('a refused line is NAMED, with its code, and the rest of the batch still lands', () => {
   const b = BATCH();
   b.lines.push(

package/tests/ui_design_kit.mjs

@@ -29,12 +29,12 @@ const readJson = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8
 test('the platform floors are a pinned list — a floor cannot vanish quietly', () => {
   assert.deepEqual([...lib.FLOORS], ['console-errors', 'failed-requests', 'horizontal-overflow', 'text-fit', 'sibling-overlap', 'one-header-main-h1', 'controls-24px', 'top-bar-80px', 'reduced-motion']);
   assert.deepEqual(lib.EXIT, { CLEAN: 0, PROBLEMS: 1, USAGE: 2, NO_BROWSER: 3 });
-  assert.deepEqual(Object.keys(lib.SIZES), ['320', '390', '1280', '1440']);
+  assert.deepEqual(Object.keys(lib.SIZES), ['320', '390', '1024', '1280', '1440']);
   assert.deepEqual([...lib.DEFAULT_SIZES], [1440, 390, 320], 'render.js renders these unless --sizes names 1280');
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
@@ -43,14 +43,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }
@@ -181,6 +181,38 @@ test('serve.js answers the manage flows with the routes\' receipts, signed in on
   } finally { out.stop(); }
 });
 
+test('serve.js holds one account for the run and refuses what the platform-identity routes refuse (task 1004259)', async () => {
+  const s = await lib.startStub({ surface: 'public-landing', auth: true });
+  try {
+    const call = (p, method, body) => fetch(s.base + '/api/bongos' + p, { method, headers: { 'content-type': 'application/json' }, body: body && JSON.stringify(body) });
+    const read = async () => (await call('/me/cross-project', 'GET')).json();
+    assert.equal((await read()).handle, 'builder', 'the fixture account answers the read');
+    // the refusals the real routes make — a stub that takes any body is how task 1003352 shipped a key the route 400s on
+    assert.equal((await call('/me/cross-project', 'PATCH', { stealth: true })).status, 400, 'an unknown key');
+    assert.equal((await call('/me/cross-project', 'PATCH', { account_visibility: 'hidden' })).status, 400, 'an off-vocabulary visibility');
+    assert.equal((await call('/me/profile', 'PATCH', { bio: 'x'.repeat(281) })).status, 400, 'a bio over its cap');
+    assert.equal((await (await call('/me/profile', 'PATCH', { links: { linkedin: 'https://evil.example/in/b' } })).json()).error.code, 'invalid_link', 'a typed link off its pinned host');
+    assert.equal((await call('/me/profile', 'PATCH', { links: { website: 'http://plain.example/' } })).status, 400, 'http is not https');
+    assert.equal((await call('/me/handle', 'PATCH', { handle: '-bad-' })).status, 400, 'a handle with a hyphen at the end');
+    assert.equal((await call('/me/handle', 'PATCH', { handle: 'taken' })).status, 409, 'the one taken handle');
+    // and what they accept comes back on the next read
+    assert.equal((await call('/me/profile', 'PATCH', { bio: '  Hello.  ' })).status, 200);
+    assert.equal((await call('/me/handle', 'PATCH', { handle: 'New-Name' })).status, 200);
+    assert.equal((await call('/me/cross-project', 'PATCH', { account_visibility: 'private' })).status, 200);
+    const after = await read();
+    assert.equal(after.bio, 'Hello.');
+    assert.equal(after.handle, 'new-name');
+    assert.equal(after.account_visibility, 'private');
+    assert.equal(after.recruiter_discoverable, null, 'going private without naming reach resets it (setAccountPrivacy)');
+    assert.equal(after.recruiter_discoverable_effective, false, 'so a private account following it is out of recruiting');
+  } finally { s.stop(); }
+  const out = await lib.startStub({ surface: 'public-landing', auth: false });
+  try {
+    assert.equal((await fetch(out.base + '/api/bongos/me/cross-project')).status, 401, 'signed out, the account is not read');
+    assert.equal((await fetch(out.base + '/api/bongos/me/profile', { method: 'PATCH', body: '{}' })).status, 401);
+  } finally { out.stop(); }
+});
+
 test('checkMock: a taste ban applies only when the instance declared it', () => {
   const dashed = GOOD_MOCK.replace('Plain copy.', 'Plain — copy.');
   const withBan = mock.checkMock(dashed, { bans: new Set(['em-dash']) });

package/tests/upgrade.mjs

@@ -279,7 +279,7 @@ t('full: pre-flight → pin → install → migrate → materialize → restart
     // The trailing `git status` is persistPin's read-only look at whether the new
     // pin is committed (task 1002712). It runs LAST — after verify — and without
     // --commit-pin it only warns, so no git add/commit/push appears here.
-    ['git status --porcelain', 'npm install --no-audit --no-fund', 'npm run migrate', 'systemctl restart emersonian.service',
+    ['git status --porcelain -uall', 'npm install --no-audit --no-fund', 'npm run migrate', 'systemctl restart emersonian.service',
       'git status --porcelain -- package.json package-lock.json',
       // task 1003926: both generators ran, so the files they rewrote are the pin commit's too
       `git status --porcelain -- ${Object.values(u.API_ARTIFACT_FILES).flat().join(' ')}`]

package/tests/upgrade_persist_pin.mjs

@@ -518,6 +518,30 @@ test('gitTreeClean: ignoring the materialized paths never waives anything else',
   assert.equal(t.ignored, 1);
 });
 
+// task 1004188: a bare `git status --porcelain` collapses a wholly-untracked directory into ONE
+// entry (`?? .claude/skills/new-in-785/`), so a waiver of FILE paths missed every file of a skill
+// directory the newer core shipped for the first time — the commonest way an upgrade dirties an
+// instance. This must be real git: a hand-written porcelain fixture lists the files you meant.
+test('gitTreeClean: a skill directory that is NEW (wholly untracked) is waived file by file', () => {
+  const dir = scratchCoTenant();
+  put(dir, '.claude/skills/new-in-785/SKILL.md', 'shipped by a newer core\n');
+  put(dir, '.claude/skills/new-in-785/helper.js', '// also new\n');
+  const t = gitTreeClean(dir, spawnSync, ['.claude/skills/new-in-785/SKILL.md', '.claude/skills/new-in-785/helper.js']);
+  assert.equal(t.dirty, '', 'no collapsed `?? dir/` entry survives the waiver');
+  assert.equal(t.ok, true);
+  assert.equal(t.ignored, 2, 'each file is counted, not the directory');
+});
+
+test('gitTreeClean: a new directory is NOT waived wholesale — an unlisted file in it still halts', () => {
+  const dir = scratchCoTenant();
+  put(dir, '.claude/skills/new-in-785/SKILL.md', 'shipped by a newer core\n');
+  put(dir, '.claude/skills/new-in-785/notes.md', 'a human dropped this here\n');
+  const t = gitTreeClean(dir, spawnSync, ['.claude/skills/new-in-785/SKILL.md']);
+  assert.equal(t.ok, false);
+  assert.match(t.dirty, /new-in-785\/notes\.md/);
+  assert.equal(t.ignored, 1);
+});
+
 test('materializeWillRewrite: the set comes from the core the instance actually has', () => {
   const dir = scratchCoTenant();
   installCore(dir, '1.19.785');