@bongos/core 1.19.346 → 1.19.348

package/scripts/gds/update-channel.js

@@ -32,6 +32,23 @@ const DEFAULT_CHANNEL = 'patch';
 // core template — a fresh instance subscribes nothing until the operator lists a target here.
 const SUBSCRIPTIONS_REL = path.join('config', 'update-subscriptions.json');
 
+// Why a roster came back the way it did. The routine reports this EVERY run: an upgrader whose only
+// job is keeping instances current must never be indistinguishable from one that has stopped. Before
+// task 1003158 an absent manifest, a malformed manifest and a deliberately empty roster all produced
+// the same silent `instances: []`, which is exactly how cloudbongos.com sat 36 releases behind for
+// days with nothing complaining (the same failure SHAPE as blocker 1000097 / task 1002521).
+const ROSTER_OK = 'ok';                       // at least one usable entry
+const ROSTER_ABSENT = 'manifest-absent';      // no file at all
+const ROSTER_MALFORMED = 'manifest-malformed';// file present, JSON unparseable
+const ROSTER_EMPTY = 'roster-empty';          // file parsed, nothing subscribable in it
+const ROSTER_REASONS = [ROSTER_OK, ROSTER_ABSENT, ROSTER_MALFORMED, ROSTER_EMPTY];
+
+// How many releases a subscribed instance may fall behind before "the upgrader stopped" is the only
+// remaining explanation. A successful sweep takes the HIGHEST permitted version in one jump, so a
+// healthy roster returns to 0 behind after every run — a backlog that keeps growing means no run is
+// landing. 5 leaves room for a busy publish-on-merge day between two daily sweeps without crying wolf.
+const DEFAULT_STALENESS_THRESHOLD = 5;
+
 // ---- semver (stable x.y.z, optional prerelease tag) -------------------------
 // A deliberately small parser — the repo avoids an npm-semver dependency in the CLI path (see
 // upgrade.js versionFromDep). We only need compare + the major/minor/patch fields.
@@ -143,16 +160,23 @@ function parseNpmViewVersions(stdout) {
 // this control plane keeps up to date. Never throws: a missing/malformed file ⇒ an empty roster
 // (subscribe nothing), because an unreadable manifest must not upgrade anything. Each entry is
 // normalized to { slug, dir, service, healthUrl, channel } with the channel validated + defaulted.
+//
+// Still fails CLOSED, no longer fails QUIET (task 1003158): every return carries a `reason` from
+// ROSTER_REASONS and a `dropped` count of entries that were unusable, so a caller can say WHY it is
+// about to do nothing. Pair it with describeRoster() for the line to print.
 function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SUBSCRIPTIONS_REL } = {}) {
   const abs = path.isAbsolute(file) ? file : path.join(instanceDir, file);
   let raw;
-  try { raw = fsImpl.readFileSync(abs, 'utf8'); } catch (_) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: false }; }
+  try { raw = fsImpl.readFileSync(abs, 'utf8'); } catch (_) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: false, dropped: 0, reason: ROSTER_ABSENT }; }
   let json;
-  try { json = JSON.parse(raw); } catch (e) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: true, error: `malformed JSON: ${e.message}` }; }
+  try { json = JSON.parse(raw); } catch (e) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: true, dropped: 0, error: `malformed JSON: ${e.message}`, reason: ROSTER_MALFORMED }; }
   const defaultChannel = normalizeChannel(json.defaultChannel);
   const rows = Array.isArray(json.instances) ? json.instances : [];
-  const instances = rows
-    .filter((r) => r && typeof r === 'object' && r.dir) // an entry without a dir can't be upgraded — drop it
+  // An entry without a dir can't be upgraded — drop it, but COUNT the drops. Silently discarding an
+  // operator's malformed row is how an instance believes it is enrolled while nothing ever touches it.
+  const usable = rows.filter((r) => r && typeof r === 'object' && r.dir);
+  const dropped = rows.length - usable.length;
+  const instances = usable
     .map((r) => ({
       slug: String(r.slug || r.dir),
       dir: String(r.dir),
@@ -178,7 +202,90 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
         ? Object.fromEntries(Object.entries(r.env).filter(([, v]) => typeof v === 'string'))
         : {},
     }));
-  return { defaultChannel, instances, source: abs, present: true };
+  return {
+    defaultChannel, instances, source: abs, present: true, dropped,
+    reason: instances.length ? ROSTER_OK : ROSTER_EMPTY,
+  };
+}
+
+// ---- reporting: make "nothing happened" audible -----------------------------
+
+// Turn a loadSubscriptions() result into the line a routine prints EVERY run, plus a level a caller
+// can act on ('ok' | 'warn' | 'alarm'). The judgement that matters is `controlPlane`: a fresh
+// instance subscribing nothing is the shipped default (ADR 0136 — the manifest ships empty), but a
+// CONTROL PLANE that subscribes nothing has silently stopped doing its only job, and that is an alarm.
+// A malformed manifest is an alarm everywhere — an operator wrote something and it does not parse.
+function describeRoster(roster, { controlPlane = false } = {}) {
+  const r = roster || {};
+  const reason = ROSTER_REASONS.includes(r.reason) ? r.reason : ROSTER_EMPTY;
+  const where = r.source || SUBSCRIPTIONS_REL;
+  const dropped = Number(r.dropped) || 0;
+  const n = Array.isArray(r.instances) ? r.instances.length : 0;
+
+  if (reason === ROSTER_MALFORMED) {
+    return { level: 'alarm', reason, count: n, dropped,
+      message: `update-subscriptions: MALFORMED manifest at ${where} (${r.error || 'unparseable'}) — subscribing NOTHING. No instance will be upgraded until this parses.` };
+  }
+  if (reason === ROSTER_ABSENT) {
+    return { level: controlPlane ? 'alarm' : 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: no manifest at ${where} — subscribing NOTHING.${controlPlane ? ' This is a CONTROL PLANE: it is supposed to keep instances current and currently keeps none.' : ' That is the shipped default; add an instance to enroll it.'}` };
+  }
+  if (reason === ROSTER_EMPTY) {
+    return { level: controlPlane ? 'alarm' : 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: manifest at ${where} lists no upgradable instance${dropped ? ` (${dropped} entr${dropped === 1 ? 'y' : 'ies'} dropped for a missing \`dir\`)` : ''} — subscribing NOTHING.${controlPlane ? ' This is a CONTROL PLANE: it is supposed to keep instances current and currently keeps none.' : ''}` };
+  }
+  // Usable entries — still surface partial loss, which is the quiet half of an enrolled-but-untouched
+  // instance: the sweep looks healthy while the operator's broken row is never upgraded.
+  if (dropped > 0) {
+    return { level: 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: ${n} instance${n === 1 ? '' : 's'} subscribed, but ${dropped} entr${dropped === 1 ? 'y was' : 'ies were'} DROPPED for a missing \`dir\` in ${where} — those instances are NOT being upgraded.` };
+  }
+  return { level: 'ok', reason, count: n, dropped,
+    message: `update-subscriptions: ${n} instance${n === 1 ? '' : 's'} subscribed from ${where}.` };
+}
+
+// ---- watching the watcher ---------------------------------------------------
+
+// How far behind is this instance in releases its OWN channel is entitled to take? Not raw version
+// distance: majors, prereleases and (on the patch channel) minors are releases the subscription is
+// correctly declining, and counting them would alarm on instances that are behaving exactly as
+// configured. `behind` is therefore "stable releases this channel WOULD have taken and has not".
+//
+// This is the check that was missing (task 1003158). deploy-divergence.js detects the SYMPTOM — live
+// is behind main — at ship time, when a human is already looking. Nothing watched whether the
+// upgrader itself was still alive, so its death was only ever discovered by someone noticing stale UI
+// days later. A healthy sweep drives `behind` to 0 every run, so a persistent backlog IS the alarm.
+//
+// A `pinned` instance is never stale: channelAllows declines everything, so behind === 0 by
+// construction. That is correct — a pinned instance is not neglected, it is pinned.
+function subscriptionStaleness({ installed, channel, available, threshold = DEFAULT_STALENESS_THRESHOLD } = {}) {
+  const ch = normalizeChannel(channel);
+  const list = Array.isArray(available) ? available : [];
+  // `installed` is parsed and the channel re-normalized ONCE, not per candidate:
+  // channelAllows re-does both on every element, and this filter is the only place
+  // that calls it in a loop. Cheap either way at registry scale — hoisted because
+  // the invariant genuinely is invariant, not because the arithmetic hurts.
+  const from = parseSemver(installed);
+  const behind = (ch === 'pinned' || !from) ? 0
+    : list.filter((v) => channelAllows(installed, v, ch)).length;
+  const t = Number(threshold);
+  const limit = Number.isFinite(t) && t >= 0 ? t : DEFAULT_STALENESS_THRESHOLD;
+  return {
+    channel: ch,
+    installed: installed == null ? null : String(installed),
+    target: resolveChannelTarget({ installed, channel: ch, available: list }),
+    behind,
+    threshold: limit,
+    stale: behind > limit,
+  };
+}
+
+// The alarm line for one subscribed instance, or null when it is healthy (nothing to say).
+function describeStaleness(st, { slug = 'instance' } = {}) {
+  if (!st || !st.stale) return null;
+  return `update-subscriptions: ${slug} is ${st.behind} ${st.channel} release${st.behind === 1 ? '' : 's'} behind `
+    + `(installed ${st.installed || 'unknown'}, entitled to ${st.target}) — over the ${st.threshold} threshold. `
+    + 'A healthy sweep clears this to zero every run, so the upgrader has most likely stopped.';
 }
 
 module.exports = {
@@ -195,4 +302,13 @@ module.exports = {
   listAvailableVersions,
   parseNpmViewVersions,
   loadSubscriptions,
+  ROSTER_OK,
+  ROSTER_ABSENT,
+  ROSTER_MALFORMED,
+  ROSTER_EMPTY,
+  ROSTER_REASONS,
+  DEFAULT_STALENESS_THRESHOLD,
+  describeRoster,
+  subscriptionStaleness,
+  describeStaleness,
 };

package/src/bongos/serve-internal.js

@@ -944,8 +944,11 @@ function mountInternalSurfaces(app) {
   // URL→gate map by parsing this file statically, and a comment in that gap drops
   // the regex out of its map — which reads as "every page on this tier is
   // ungated". It fails loudly by design; keep prose above the const.
+  // task 1003172 (C02): `collab` joins the same tier — every read behind it is
+  // any-builder and scoped to the caller by the SERVER (GET /help-requests/for-me
+  // derives crafts from the viewer's own profile), so signed-in is the right floor.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|ideas|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|ideas|collab|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -1122,8 +1122,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.344 with no explicit bump. run 32800819617. (task 1002620)
 //   1.19.346 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.345 with no explicit bump. run 32801147433. (task 1002620)
+//   1.19.347 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.346 with no explicit bump. run 32802265337. (task 1002620)
+//   1.19.348 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.347 with no explicit bump. run 32802746363. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.346'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.348'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/client_baseurl_guard.mjs

@@ -0,0 +1,122 @@
+// tests/client_baseurl_guard.mjs — the guard that stops a page 404ing every call
+// (task 1003263).
+//
+// Three pages shipped the defect this guard exists to catch: ideas.js and idea.js
+// were dead in production from the day they shipped, and collab.js was caught one
+// commit before it would have joined them. So the guard itself is worth testing on
+// synthetic sources rather than only on the live tree — a scan that passes because
+// the tree happens to be clean today proves nothing about what it would REFUSE.
+//
+// Every case below is an in-memory file: no fixtures on disk, no dependence on the
+// current state of modules/hall-ui/public/.
+//
+// Run:  node tests/client_baseurl_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { checkClientBaseUrl, scanPages } = require('../scripts/gds/client-baseurl-guard.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const from = (map) => ({
+  files: Object.keys(map),
+  read: (rel) => (rel in map ? map[rel] : null),
+});
+
+// --- THE DEFECT ------------------------------------------------------------
+
+test('the exact shipped defect is refused: baseUrl:\'\' plus a namespaced call', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/bad.js':
+      "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + 'const r = await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /bad\.js/);
+  assert.match(violations[0], /site root/, 'the message says WHY it is wrong, not just that it is');
+  assert.match(violations[0], /Drop the baseUrl override/, 'and what to do about it');
+});
+
+test('double-quoted and backtick empty bases are the same defect', () => {
+  for (const empty of ['""', '``']) {
+    const { violations } = scanPages(...Object.values(from({
+      'public/p.js': `const api = createClient({ baseUrl: ${empty} });\napi.me.getMe({});\n`,
+    })));
+    assert.equal(violations.length, 1, `baseUrl: ${empty} must be caught`);
+  }
+});
+
+// --- WHAT IT MUST NOT FLAG -------------------------------------------------
+// A guard that fires on correct code gets suppressed, and then it protects nothing.
+
+test("the escape-hatch style is CORRECT with baseUrl:'' — never flagged", () => {
+  // work.js, copy-desk.js and most of the hall do exactly this: empty base, but
+  // every path written out in full. Flagging it would be a false positive on the
+  // majority of the hall.
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/work.js':
+      "const API = '/api/bongos';\n"
+      + "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + "const res = await api.request('GET', `${API}/tasks`);\n",
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('the fix itself passes — omitting baseUrl with namespaced calls is correct', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/ideas.js':
+      "const api = window.BongosClient.createClient({ credentials: 'same-origin', throwOnError: false });\n"
+      + 'await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.deepEqual(violations, [], 'the shipped fix must not trip the guard that motivated it');
+});
+
+test('a non-empty baseUrl is a deliberate choice, not the defect', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'public/ext.js':
+      "const api = createClient({ baseUrl: 'https://other.example/api/bongos/v1' });\n"
+      + 'api.me.getMe({});\n',
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('a page that builds no client at all is ignored', () => {
+  const { violations, usingClient } = scanPages(...Object.values(from({
+    'public/static.js': "document.querySelector('#x').textContent = 'hi';\n",
+  })));
+  assert.deepEqual(violations, []);
+  assert.equal(usingClient, 0);
+});
+
+// --- THE SCAN MUST NOT SILENTLY SUCCEED ------------------------------------
+
+test('an empty enumeration is a hard FAIL, not a clean pass', () => {
+  // The failure mode that makes a guard worthless: git ls-files returns nothing,
+  // zero files are scanned, and the check reports green forever.
+  const r = checkClientBaseUrl({ files: [], read: () => null });
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations[0], /scan defect/);
+});
+
+test('an unreadable file is skipped without being counted as scanned', () => {
+  const { scanned } = scanPages(['gone.js'], () => null);
+  assert.equal(scanned, 0);
+});
+
+test('the check reports hardFail so CI actually stops', () => {
+  const r = checkClientBaseUrl(from({
+    'public/bad.js': "createClient({ baseUrl: '' });\napi.inbox.postInbox({});\n",
+  }));
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true, 'a page dead in prod is not a warning');
+});
+
+console.log(`\nclient_baseurl_guard: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/collab_page.mjs

@@ -0,0 +1,172 @@
+// tests/collab_page.mjs — the Collab page (task 1003172 / C02, goal 1000075,
+// criterion collab-page-matches-my-craft).
+//
+// The criterion has three clauses and the third is the one that gets skipped:
+// requests match the viewer's CRAFT, are ANSWERABLE from the page, and a request
+// nobody takes is VISIBLY AGING rather than silently dead. Sorting the oldest to
+// the top does not satisfy the third — the oldest then looks exactly like the
+// newest, only lower down.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+// collab-lib.js is pure, so RUN it rather than grep it.
+function lib() {
+  const src = read('modules', 'hall-ui', 'public', 'collab-lib.js');
+  const win = {};
+  new Function('window', src)(win);
+  return win.OTBCollabLib;
+}
+const NOW = Date.parse('2026-08-24T12:00:00Z');
+const daysAgo = (d) => new Date(NOW - d * 86400000).toISOString();
+
+// ---- THE AGEING CLAUSE ----------------------------------------------------
+test('age is a BAND with a label, not just a sort position', () => {
+  const L = lib();
+  assert.equal(L.ageBand(daysAgo(0), NOW).id, 'fresh');
+  assert.equal(L.ageBand(daysAgo(1), NOW).id, 'waiting');
+  assert.equal(L.ageBand(daysAgo(3), NOW).id, 'aging');
+  assert.equal(L.ageBand(daysAgo(7), NOW).id, 'stale');
+  assert.equal(L.ageBand(daysAgo(90), NOW).id, 'stale');
+  for (const b of L.BANDS) assert.ok(b.label && b.label.length > 4, `${b.id} says it in words`);
+});
+
+test('the boundaries are exact, so the bands mean something', () => {
+  const L = lib();
+  assert.equal(L.ageBand(daysAgo(0.99), NOW).id, 'fresh', 'just under a day is still fresh');
+  assert.equal(L.ageBand(daysAgo(2.99), NOW).id, 'waiting');
+  assert.equal(L.ageBand(daysAgo(6.99), NOW).id, 'aging');
+});
+
+test('an unknown age reads as fresh, never as an accusation', () => {
+  const L = lib();
+  for (const bad of [null, undefined, '', 'nonsense']) {
+    assert.equal(L.ageBand(bad, NOW).id, 'fresh', `${JSON.stringify(bad)} must not look neglected`);
+  }
+});
+
+test('ageing changes how a row LOOKS, not only where it sits', () => {
+  // The whole point of the clause. Each band must have its own visual treatment
+  // in CSS, or "visibly aging" is just a sort order with extra steps.
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  const L = lib();
+  for (const b of L.BANDS) {
+    assert.match(css, new RegExp(`\\.cb-item--${b.id}\\b`), `${b.id} has its own styling`);
+  }
+  assert.match(css, /\.cb-item--stale\s*\{[^}]*border-left-color/, 'the band reads down a list at a glance');
+  // Colour alone is not a message and not everyone sees it.
+  assert.match(css, /\.cb-item--stale \.cb-age/, 'and the words are emphasised too');
+});
+
+test('the row markup carries the band class and the label', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(js, /cb-item--\$\{L\.ageBand\(/, 'the class comes from the band');
+  assert.match(js, /cb-age cb-age--\$\{band\.id\}/, 'and so does the chip');
+  assert.match(js, /escapeHtml\(band\.label\)/, 'the label is rendered, escaped');
+});
+
+test('oldest first WITHIN the page, in addition to the band', () => {
+  const L = lib();
+  const rows = [{ created_at: daysAgo(1) }, { created_at: daysAgo(9) }, { created_at: daysAgo(4) }];
+  const sorted = rows.slice().sort(L.byAgeOldestFirst);
+  assert.deepEqual(sorted.map((r) => L.ageBand(r.created_at, NOW).id), ['stale', 'aging', 'waiting']);
+});
+
+// ---- THE MATCHING CLAUSE --------------------------------------------------
+test('the page NEVER sends a craft — matching is the server\'s job', () => {
+  // C01's grader found a ?craft= param that let any builder read another craft's
+  // requests. The fix put craft derivation on the server, and this page must not
+  // reintroduce the parameter from the client side.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  // Assert on the REQUEST, not on any occurrence of the word: the first version
+  // matched `Matching your craft: ${crafts.join(', ')}` — the page's own subtitle —
+  // which is display text, not a parameter. Fifth time this session that a source
+  // assertion has been wider than its invariant (learning 1000196).
+  assert.match(js, /getHelpRequestsForMe\(\{\}\)/, 'the read is unparameterised');
+  assert.ok(!/(query|body):\s*\{[^}]*craft/.test(js), 'craft never travels in a query or body');
+});
+
+test('a craft request and a by-name request read differently', () => {
+  const L = lib();
+  assert.match(L.addressedTo({ needs_craft: 'artist' }, 1), /artists/);
+  assert.match(L.addressedTo({ needs_builder_id: 7 }, 7), /by name/);
+  assert.match(L.addressedTo({ needs_builder_id: 7 }, 9), /one person/);
+});
+
+test('context links to the task or goal, and to neither when absent', () => {
+  const L = lib();
+  assert.equal(L.contextOf({ task_id: 5 }).kind, 'task');
+  assert.equal(L.contextOf({ goal_id: 5 }).kind, 'goal');
+  assert.equal(L.contextOf({}), null, 'no context means no element, not an empty one');
+});
+
+// ---- THE ANSWERABLE CLAUSE ------------------------------------------------
+test('the asker can settle in place, with both outcomes', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(js, /data-settle="answered"/);
+  assert.match(js, /data-settle="withdrawn"/);
+  assert.match(js, /patchHelpRequestsId/, 'through the real API, not a local edit');
+});
+
+test('there is deliberately NO reply thread — that would reimplement the Agora', () => {
+  // The goal forbids reimplementing the Agora to get around C06's dependency.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  for (const f of ['reply', 'comment', 'thread', 'message']) {
+    assert.ok(!new RegExp(`data-${f}|post${f}`, 'i').test(js), `no ${f} surface`);
+  }
+});
+
+// ---- placement ------------------------------------------------------------
+test('it is a PAGE, not a Home card — the actionable half is the needs roster', () => {
+  // hall-ui/CLAUDE.md's tree: an action awaiting the builder goes in the
+  // needs-attention inbox and NEVER a new card, because one landing place for
+  // everything actionable is the whole point. C01 already put it there.
+  assert.ok(fs.existsSync(path.join(HALL, 'collab.html')));
+  const builders = read('modules', 'hall-ui', 'public', 'builders.js');
+  assert.ok(!/collab/i.test(builders), 'no Home card was added');
+});
+
+test('the page is behind the signed-in gate', () => {
+  const serve = read('src', 'bongos', 'routes', '..', 'serve-internal.js');
+  const m = /const SIGNEDIN_BUILDERS_PAGE_RE =\s*(\/[^\n]+\/);/.exec(serve);
+  assert.ok(m, 'the gate const is still statically parseable');
+  assert.ok(new RegExp(m[1].slice(1, -1)).test('/builders/collab'), 'collab is gated');
+});
+
+test('every CSS token the page uses exists in style.css', () => {
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  const style = read('modules', 'hall-ui', 'public', 'style.css');
+  const used = new Set([...css.matchAll(/var\((--[a-z-]+)\)/g)].map((x) => x[1]));
+  assert.ok(used.size >= 5);
+  for (const t of used) {
+    assert.ok(new RegExp(`^\\s*${t}:`, 'm').test(style), `${t} must be defined (idea 1000821)`);
+  }
+});
+
+// ---- THE CLIENT ACTUALLY REACHES THE API ----------------------------------
+// The page called every endpoint through the GENERATED client (api.helpRequests.*),
+// whose methods emit API-RELATIVE paths ('/help-requests/for-me'). Combined with
+// baseUrl:'' — which the client documents as "these paths are already absolute" —
+// every request went to the SITE ROOT and 404'd, so the page would have shipped
+// dead on arrival. ideas.js and idea.js already shipped with exactly this defect.
+//
+// Grepped rather than executed on purpose: the defect is in URL CONSTRUCTION, and
+// every existing test stubs the client, which is precisely why three pages shipped
+// green while 404ing. A repo-wide version of this guard belongs in fitness.js once
+// the two idea pages are fixed — scoped here to the page this task owns.
+test('the client is not configured to send API calls to the site root', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  const namespaced = [...js.matchAll(/\bapi\.([a-zA-Z]\w*)\.([a-zA-Z]\w*)\(/g)];
+  assert.ok(namespaced.length > 0, 'this page uses the generated client');
+  assert.ok(
+    !/createClient\(\{[^}]*baseUrl:\s*(''|"")/.test(js),
+    "baseUrl:'' sends generated-client paths to the site root — drop it so they "
+    + 'resolve against /api/bongos/v1, or switch every call to api.request() with a full path',
+  );
+});

package/tests/hall_nav.mjs

@@ -149,7 +149,13 @@ test('sidebar groups read by audience, in order', () => {
   // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
   // so the nav entry reads 'government' since ADR 0174 (it said 'archon', then
   // was stricter than the wall). requireProjectCuratePage is the wall server-side.
-  assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard', 'people'], 'Community = everyone else');
+  // task 1003172 (C02 of goal 1000075): 'collab' joins Community, FIRST. The
+  // group is picked by whose data it is, and a help request is another builder
+  // reaching you — not your own numbers (that is You), and not reference (Docs).
+  // First within the group because it is the one page here you ACT on; the
+  // leaderboard and the directory are browsing surfaces. Updating this oracle is
+  // the reviewed decision the pin exists to force.
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'leaderboard', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.

package/tests/idea_hall_composer.mjs

@@ -112,6 +112,17 @@ await test('the page gets both the FORM and the METER from the server', () => {
   assert.match(IDEAS_JS, /getInboxTemplate/, 'the form is rendered from GET /inbox/template');
   assert.match(IDEAS_JS, /postInboxScore/, 'the meter is filled from POST /inbox/score');
   assert.match(IDEAS_JS, /postInbox\b/, 'and it files through POST /inbox');
+
+  // ...AND THOSE CALLS MUST REACH THE API. The three assertions above are regexes
+  // over the SOURCE TEXT, so they passed for months while the page 404'd on every
+  // one of them: baseUrl:'' told the client the API-relative templates were already
+  // absolute, and each request went to the site root. Naming a method proves the
+  // call is written, never that it is addressed — task 1003263.
+  assert.doesNotMatch(
+    IDEAS_JS,
+    /createClient\(\s*\{[^}]*baseUrl\s*:\s*(''|"")/,
+    "baseUrl:'' sends the generated client's API-relative paths to the site root",
+  );
 });
 
 await test('the page does not print a pass bar — that rule lives in economy', () => {