@bongos/core 1.19.262 → 1.19.263

package/modules/hall-ui/public/goals-page.js

@@ -23,6 +23,14 @@
 (function () {
   'use strict';
   const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;
   // Shared component kit (hall-kit.js, task 2166): pager, filter bar, tabs,
   // empty/skeleton states — adopted here by task 2171.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar,
@@ -497,40 +505,10 @@
   // ===================================================================
 
   // Board-identical numeric helpers (work.js:214-240).
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward); const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
   // Two tasks can't run in parallel if their touches[] overlap (exact path or a
   // directory-prefix either way); empty touches never conflict. Powers the
   // filter bar's "Run mode" control (work.js:230-239).
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
   // Per-task rank floor tag (work.js:247-254).
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // Free-text search over the goal's todo list (work.js:261-274, minus the
   // goal-title match — a single goal makes that redundant).
   function todoSearchQuery() {
@@ -548,21 +526,6 @@
 
   // Copy-prompt (work.js:454-503). deHashRefs stops a bare #NNN autolinking to
   // GitHub in a pasted session; the prompt points the builder at the hall task URL.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
   async function copyPromptForTask(taskId, btn) {
     const t = state.work.todo.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -697,21 +660,6 @@
     }
   }
   // A single batch-item failure reason → a readable fragment (work.js:545-562).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
   // Bulk claim the selected ready cards (work.js doBulkClaim, claims/batch is
   // all-or-nothing: a 409 batch_failed means nothing was claimed). Reloads the
   // goal's tasks either way so the cards reflect fresh truth.

package/modules/hall-ui/public/goals.html

@@ -194,6 +194,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — pager, filter bar, tabs, empty/skeleton (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
 <script src="/builders/goals-page.js?v=2026-07-10-goals5"></script>

package/modules/hall-ui/public/task-lib.js

@@ -0,0 +1,136 @@
+// modules/hall-ui/public/task-lib.js — the hall's shared TASK-DOMAIN helpers
+// (task 1002463, from idea 1000567).
+//
+// WHY A SIBLING OF hall-kit.js RATHER THAN PART OF IT. hall-kit.js is explicitly
+// "the SIX primitives every page redesign adopts" — pager, ledger, filter bar,
+// tabs, section rail, empty/skeleton/collapsible. Those are UI *markup* factories,
+// and modules/hall-ui/CLAUDE.md's "no bespoke pager / filter / tab / rail markup"
+// rule is scoped to exactly that. The functions below are task-DOMAIN logic
+// (how a task is ranked, whether two touches[] collide, what a refusal means in
+// English). Folding them into the kit would blur a contract that is currently
+// crisp, so they get their own namespace instead.
+//
+// Contract, mirrored from hall-kit.js so load order only needs "before the page
+// script": dependency-free (own esc(), no window.OTB use), no eval-time DOM, and
+// everything hangs off one global. Node-require-safe so it can be unit-tested.
+//
+// WHAT THIS FIXES. Before extraction these lived in TWO copies (work.js and
+// goals-page.js) and had already drifted: goals-page.js's friendlyBatchReason had
+// silently lost the MODULE_CONFLICT case that work.js handles, so a batch-claim
+// refused for a module collision showed the raw code "MODULE_CONFLICT" to the
+// builder on the Goals page and a sentence on the Tasks board. One copy, one
+// behaviour, and the drift cannot re-open.
+(() => {
+  'use strict';
+
+  // Local HTML-escape — deliberately NOT window.OTB.escapeHtml, so this file
+  // keeps hall-kit's dependency-free property (same reasoning, same duplication
+  // of ~4 lines being cheaper than a load-order constraint).
+  function esc(s) {
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    }[c]));
+  }
+
+  // Sort key for a "P3"-style priority string. Unparseable/absent sorts last.
+  function priorityRank(p) {
+    if (!p) return 99;
+    const m = /^P(\d+)/i.exec(String(p));
+    return m ? Number(m[1]) : 99;
+  }
+
+  // Do two touches[] lists collide? A path collides with itself and with anything
+  // under it, so "src/" conflicts with "src/gds/db.js". Trailing slashes are
+  // normalised first so "src" and "src/" are the same path.
+  function touchesConflict(aList, bList) {
+    const norm = (p) => String(p).replace(/\/+$/, '');
+    for (const a of (Array.isArray(aList) ? aList : [])) {
+      const na = norm(a);
+      for (const b of (Array.isArray(bList) ? bList : [])) {
+        const nb = norm(b);
+        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
+      }
+    }
+    return false;
+  }
+
+  // The rank-floor chip. 'xenos' means no floor at all, which reads as an
+  // invitation ("Any rank") rather than a restriction.
+  function rankTagHtml(requiresRank) {
+    const rr = (requiresRank || 'xenos').toLowerCase();
+    if (rr === 'xenos') {
+      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
+    }
+    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
+    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${esc(label)}</span>`;
+  }
+
+  // Strip bare "#NNN" GDS refs from prose we are about to paste elsewhere: on
+  // GitHub a bare #NNN autolinks to an ISSUE, and our ids are not GitHub's, so
+  // the link 404s. (Same rule the repo enforces in committed markdown.)
+  // VERBATIM from the two originals — do not "tidy" either detail:
+  //  • `\d{1,5}` (not `\d+`) is load-bearing by omission: a 6+ digit run never
+  //    matches at all, so long numerics are left untouched rather than rewritten.
+  //  • `text == null ? '' : text` (not `text || ''`) keeps falsy-but-real inputs:
+  //    deHashRefs(0) must render "0", not "". `|| ''` would swallow it.
+  // Both were silently changed in an earlier draft of this extraction and the
+  // regression escaped an equivalence pass whose inputs were all strings/null.
+  function deHashRefs(text) {
+    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
+  }
+
+  // Reward density, for the "best value" sort. -Infinity (not 0) for anything
+  // unpriced or unestimated so those sink below every real ratio instead of
+  // tying with a genuinely zero-value task.
+  function creditsPerMinute(t) {
+    const c = Number(t.credits_reward);
+    const m = Number(t.est_minutes);
+    if (!c || !m || m <= 0) return -Infinity;
+    return c / m;
+  }
+
+  // The paste-into-your-agent prompt for one task.
+  function buildPromptForTask(t) {
+    const desc = deHashRefs((t.description || '').trim());
+    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
+    const hallUrl = `${hallBase}#/task/${t.id}`;
+    return [
+      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
+      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
+      ``,
+      `Task description:`,
+      desc || '(no description)',
+    ].join('\n');
+  }
+
+  // Turn a batch-claim refusal into a sentence. THE DEFAULT MATTERS: an unmapped
+  // code falls through to the raw string, which is how the missing MODULE_CONFLICT
+  // case leaked a machine code into the Goals page UI. Adding a server-side reason
+  // without adding it here degrades quietly rather than loudly, so keep this in
+  // step with the claim route's refusal codes.
+  function friendlyBatchReason(item) {
+    switch (item && item.reason) {
+      case 'TASK_NOT_FOUND': return 'no longer exists';
+      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
+      case 'ALREADY_CLAIMED': return 'already claimed';
+      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
+      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
+      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
+        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
+        : `shares module "${item.module_key}" with an active claim`;
+      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
+      case 'rank_too_low_for_task':
+      case 'XENOS_RESTRICTED':
+      case 'INSUFFICIENT_RANK': return 'rank too low';
+      case 'BUILDER_INACTIVE': return 'account inactive';
+      default: return (item && item.reason) || 'not claimable';
+    }
+  }
+
+  const api = {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  };
+  if (typeof window !== 'undefined') window.OTBTaskLib = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/work.html

@@ -135,6 +135,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->
 <script src="/builders/hall-kit.js" defer></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js" defer></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/work.js?v=2026-07-03-workboard3" defer></script>

package/modules/hall-ui/public/work.js

@@ -36,6 +36,14 @@
   // file's exact variants (date-only fmtDate; a 2200ms clearing toast).
   // fmtAgo / toAuth / getJSON / postJSON stay local below.
   const { escapeHtml, $, fmtNum } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;   // deHashRefs is not called here — it is used inside buildPromptForTask
   // Shared component kit (hall-kit.js, task 2166): tabs, pager, filter bar.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar } = window.OTBKit;
   const fmtDate = (iso) => window.OTB.fmtDate(iso);
@@ -211,48 +219,14 @@
   const sequentialCache = { key: '', order: null };
   let sequentialDebounce = null;
 
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward);
-    const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
-
   // task 1756: two tasks can't run in parallel if their touches[] overlap — exact
   // path match or a directory-prefix either way (mirrors the server's touchesOverlap
   // / the goals-page conflict estimate). Empty touches never conflict.
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
-
   // task 1752 (+ 1498 / ADR 0084): the minimum rank to claim a task, as a tag shown
   // on EVERY task row. 'xenos' is the open default → a muted "Any rank" tag (open to
   // all, not a warning); 'archon' shows bare; other ranks show 'Rank+'. Kept here for
   // now; the shared task-detail view (task 1753) will lift this into the common
   // toolkit so every task surface renders rank identically.
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // task 1829: free-text search over the claimable/backlog lists. Matches the
   // query (case-insensitive substring) against the task id (with or without a
   // leading '#'), the title, and the goal title (taskState.goalTitles — the
@@ -455,23 +429,6 @@
   // our records number tasks separately from GitHub. So the scroll we hand the
   // builder must never carry a bare "#NNN": write "task NNN" + the clickable hall
   // URL, and strip "#NNN" out of the (free-text) task description too.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
-
   async function copyPromptForTask(taskId, btn) {
     const t = taskState.all.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -546,25 +503,6 @@
   // /claims/batch/validate) to a builder-readable fragment. Distinct from
   // friendlyActionError above because a batch item's shape differs (reason,
   // not error; extra fields like conflictsWithTaskId/module_key).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
-        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
-        : `shares module "${item.module_key}" with an active claim`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
-
   async function copyText(text) {
     try { await navigator.clipboard.writeText(text); return true; }
     catch (_) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.262",
+  "version": "1.19.263",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.262",
+      "version": "1.19.263",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.262",
+  "version": "1.19.263",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -951,8 +951,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.260 with no explicit bump. run 32295699354. (task 1002620)
 //   1.19.262 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.261 with no explicit bump. run 32298063660. (task 1002620)
+//   1.19.263 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.262'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.263'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_criterion_confirm_ui.mjs

@@ -32,6 +32,11 @@ import { makeRunner } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-page.js'), 'utf8');
+// task 1002463: goals-page.js now pulls its task-domain helpers from the shared
+// window.OTBTaskLib (task-lib.js) instead of holding its own drifted copies. Run
+// the REAL file in the same context rather than stubbing it — stubbing would let
+// the extraction rot without this, the only test that executes either board.
+const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
 
 const { test, summary } = makeRunner();
 
@@ -126,6 +131,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).

package/tests/task_lib.mjs

@@ -0,0 +1,115 @@
+// tests/task_lib.mjs
+//
+// task 1002463 — the shared task-domain helpers extracted out of work.js and
+// goals-page.js into modules/hall-ui/public/task-lib.js.
+//
+// WHY THIS FILE EXISTS. The extraction was verified by an equivalence pass against
+// the pristine pre-refactor sources — and that pass MISSED two real regressions,
+// because every input it fed deHashRefs was a string or null. A grader caught them:
+// the digit bound had been "tidied" from \d{1,5} to \d+, and the null guard from
+// (text == null ? '' : text) to (text || ''). Both are behaviour changes hiding in
+// a refactor. The lesson is that equivalence proofs are only as good as their input
+// domain, so the boundaries now have named, checked-in cases.
+//
+// Run:  node tests/task_lib.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const T = require(join(ROOT, 'modules/hall-ui/public/task-lib.js'));
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---- deHashRefs: the two regressions, pinned ------------------------------
+t('deHashRefs rewrites a 1-5 digit ref (GitHub would autolink it to an issue)', () => {
+  assert.equal(T.deHashRefs('see #123'), 'see task 123');
+  assert.equal(T.deHashRefs('#1'), 'task 1');
+  assert.equal(T.deHashRefs('#12345'), 'task 12345');
+});
+
+t('deHashRefs LEAVES a 6+ digit run alone — \\d{1,5} is load-bearing by omission', () => {
+  // \d{1,5} followed by \b cannot match inside a longer digit run: after 5 digits
+  // the next char is still a word char, so there is no boundary and no match at
+  // all. Widening to \d+ silently changed this. Pinned so it cannot drift back.
+  assert.equal(T.deHashRefs('#123456'), '#123456');
+  assert.equal(T.deHashRefs('#1002463'), '#1002463');
+  assert.equal(T.deHashRefs('#12345 and #123456'), 'task 12345 and #123456');
+});
+
+t('deHashRefs keeps falsy-but-real input — (text == null) not (!text)', () => {
+  // `text || ''` would swallow these into the empty string.
+  assert.equal(T.deHashRefs(0), '0');
+  assert.equal(T.deHashRefs(false), 'false');
+  assert.equal(T.deHashRefs(NaN), 'NaN');
+  // ...while genuinely absent input is still the empty string.
+  assert.equal(T.deHashRefs(null), '');
+  assert.equal(T.deHashRefs(undefined), '');
+});
+
+// ---- touchesConflict: the parallel-safety predicate -----------------------
+t('touchesConflict: a path collides with itself, its parents and its children', () => {
+  assert.equal(T.touchesConflict(['src'], ['src']), true);
+  assert.equal(T.touchesConflict(['src'], ['src/gds/db.js']), true);
+  assert.equal(T.touchesConflict(['src/gds/db.js'], ['src']), true);
+  assert.equal(T.touchesConflict(['src'], ['srcery']), false, 'prefix must not count as a parent');
+  assert.equal(T.touchesConflict(['a'], ['b']), false);
+});
+
+t('touchesConflict: trailing slashes normalise, non-arrays are inert', () => {
+  assert.equal(T.touchesConflict(['src/'], ['src']), true);
+  assert.equal(T.touchesConflict(null, ['src']), false);
+  assert.equal(T.touchesConflict('src', ['src']), false, 'a bare string is not a list');
+});
+
+// ---- priorityRank / creditsPerMinute: sort keys ---------------------------
+t('priorityRank: unparseable or absent sorts LAST, not first', () => {
+  assert.equal(T.priorityRank('P1'), 1);
+  assert.equal(T.priorityRank('P5'), 5);
+  assert.equal(T.priorityRank(null), 99);
+  assert.equal(T.priorityRank('nonsense'), 99);
+});
+
+t('creditsPerMinute: unpriced/unestimated sinks below a genuine zero ratio', () => {
+  assert.equal(T.creditsPerMinute({ credits_reward: 10, est_minutes: 5 }), 2);
+  assert.equal(T.creditsPerMinute({ credits_reward: 0, est_minutes: 5 }), -Infinity);
+  assert.equal(T.creditsPerMinute({ credits_reward: 10, est_minutes: 0 }), -Infinity);
+  assert.equal(T.creditsPerMinute({}), -Infinity);
+});
+
+// ---- friendlyBatchReason: the bug this extraction fixed -------------------
+t('friendlyBatchReason explains MODULE_CONFLICT — the case goals-page.js had lost', () => {
+  assert.match(
+    T.friendlyBatchReason({ reason: 'MODULE_CONFLICT', module_key: 'ideas', conflictsWithTaskId: 7 }),
+    /shares module "ideas" with task #7/
+  );
+  assert.match(
+    T.friendlyBatchReason({ reason: 'MODULE_CONFLICT', module_key: 'ideas' }),
+    /shares module "ideas" with an active claim/
+  );
+});
+
+t('friendlyBatchReason falls through to the raw code for an unmapped reason', () => {
+  // The failure mode this guards: a new server-side refusal code degrades to the
+  // machine string in the UI rather than throwing. Loud enough to notice, safe.
+  assert.equal(T.friendlyBatchReason({ reason: 'SOME_NEW_CODE' }), 'SOME_NEW_CODE');
+  assert.equal(T.friendlyBatchReason(null), 'not claimable');
+});
+
+// ---- rankTagHtml: escaping ------------------------------------------------
+t('rankTagHtml escapes its label and treats xenos as "no floor"', () => {
+  assert.match(T.rankTagHtml('xenos'), /Any rank/);
+  assert.match(T.rankTagHtml('metic'), /Metic\+/);
+  assert.match(T.rankTagHtml('archon'), /Archon</, 'archon takes no + suffix');
+  assert.doesNotMatch(T.rankTagHtml('<img src=x onerror=1>'), /<img/);
+});
+
+console.log(`\ntask-lib tests: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);