@bongos/core 1.19.381 → 1.19.382

package/tests/profile_activity.mjs

@@ -0,0 +1,625 @@
+// tests/profile_activity.mjs
+//
+// task 1003281 (goal 1000072, criterion legibility-activity-by-role) — "See what
+// you did, by role", including the idea trail.
+//
+// The done-when, as assertions: the owner opens their profile, switches to the
+// ideator view, sees EVERY idea they ever captured with what became of it, and
+// can click through to the task a promotion produced.
+//
+// Five things are pinned here, and each one is a bug that is invisible in review:
+//   1. ROUTE ORDER — GET /inbox/by-builder/:id must be declared before
+//      GET /inbox/:id, or `:id` binds the literal "by-builder" and parseId 400s
+//      the entire trail. The fourth route in that file to need this.
+//   2. THE FOUR OUTCOMES ALL RENDER, and an OPEN idea reads as "still open"
+//      rather than as an absence — the criterion names open as an outcome.
+//   3. THE CRAFT AXIS REACHES THE SERVER — switching to a craft tab must change
+//      the request, not filter a page the browser already holds. A client-side
+//      filter over a page window shows the wrong count and the wrong rows.
+//   4. PRIVATE GOALS ARE FILTERED IN SQL, not after the LIMIT — thinning rows
+//      after paging makes the pager lie about the total.
+//   5. SIGNED OUT, the activity section says why it is empty and issues NO
+//      activity requests; the public portfolio above it is untouched.
+//
+// DB-free: `api.pool.query` is patched before the modules load (the
+// idea_spark_queue.mjs idiom), so the REAL SQL is captured and the REAL handlers
+// run. The page half runs the REAL profile.js in a vm against a stub DOM and a
+// stub OTBKit that captures each ledger's rowHtml (the idea_detail_page.mjs
+// idiom) — so what is asserted is the HTML a reader would actually get.
+//
+// Run:  node tests/profile_activity.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// 0. the doorway pool, patched before anything requires it
+// ---------------------------------------------------------------------------
+
+const api = require('../src/module-api.js');
+let queries = [];
+let nextRows = [];
+let nextCount = 0;
+// A `count(*)` in the SQL cannot tell the two apart — the goals PAGE query
+// carries `count(*) FILTER (…)` inside its rollup CTE. The page window is what
+// distinguishes them, so LIMIT is the discriminator here and below.
+const isPageQuery = (sql) => /\sLIMIT\s/i.test(sql);
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (!isPageQuery(sql)) return { rows: [{ n: nextCount, total: nextCount }] };
+  return { rows: nextRows };
+};
+const resetSql = () => { queries = []; nextRows = []; nextCount = 0; };
+const listSql = () => queries.find((q) => isPageQuery(q.sql));
+const countSql = () => queries.find((q) => !isPageQuery(q.sql));
+
+const inbox = require('../modules/ideas/inbox.js');
+const activity = require('../modules/lifecycle/activity.js');
+const ideaRoutesFactory = require('../modules/ideas/routes/inbox.js');
+
+// ---------------------------------------------------------------------------
+// 1. route order — the invisible 400
+// ---------------------------------------------------------------------------
+
+const ideaRouter = ideaRoutesFactory({});
+const mountedPaths = ideaRouter.stack.filter((l) => l.route).map((l) => l.route.path);
+
+await test('GET /inbox/by-builder/:id is declared BEFORE GET /inbox/:id', () => {
+  const trail = mountedPaths.indexOf('/inbox/by-builder/:id');
+  const byId = mountedPaths.indexOf('/inbox/:id');
+  assert.ok(trail > -1, 'the trail route is mounted');
+  assert.ok(byId > -1, 'the by-id route is mounted');
+  assert.ok(trail < byId, `/inbox/by-builder/:id (${trail}) must precede /inbox/:id (${byId}) or :id swallows it`);
+});
+
+// ---------------------------------------------------------------------------
+// 2. the trail route — shape, clamping, and the rank gate riding through
+// ---------------------------------------------------------------------------
+
+function handlerFor(router, pathStr, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pathStr && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${pathStr} is not mounted`);
+  const stack = layer.route.stack.map((s) => s.handle);
+  return stack[stack.length - 1];
+}
+const trailHandler = handlerFor(ideaRouter, '/inbox/by-builder/:id', 'get');
+
+function callTrail({ params = { id: '95' }, query = {}, rank = 'metic' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = { params, query, body: {}, builder: { id: '9', rank } };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    Promise.resolve(trailHandler(req, res, (err) => reject(err || new Error('next() called')))).catch(reject);
+  });
+}
+
+await test('the trail returns every idea this builder filed, with its total', async () => {
+  resetSql();
+  nextRows = [{ id: '1', title: 'A', status: 'open' }, { id: '2', title: 'B', status: 'promoted' }];
+  nextCount = 2;
+  const r = await callTrail();
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.builder_id, 95);
+  assert.equal(r.payload.ideas.length, 2);
+  assert.equal(r.payload.total, 2);
+});
+
+await test('the trail is scoped to the PERSON, not to a status — a triaged idea stays in it', async () => {
+  resetSql();
+  await callTrail();
+  const sql = listSql().sql;
+  assert.ok(/i\.captured_by = \$1/.test(sql), 'scoped by captured_by');
+  assert.ok(!/i\.status\s*=\s*'open'/.test(sql), "the trail must NOT filter to status='open' — that is the bug it exists to fix");
+});
+
+await test('the trail resolves each outcome to a NAME, not just an id', async () => {
+  resetSql();
+  await callTrail();
+  const sql = listSql().sql;
+  assert.ok(/LEFT JOIN tasks pt ON pt\.id = i\.promoted_to_task_id/.test(sql), 'the promoted task is joined for its title');
+  assert.ok(/LEFT JOIN idea_inbox mi ON mi\.id = i\.merged_into_idea_id/.test(sql), 'the merge target is joined for its title');
+  assert.ok(/ideas_task_lineage/.test(sql), 'the one-idea-many-tasks lineage rides along');
+});
+
+await test('the list and the count share ONE predicate, viewer rank included', async () => {
+  resetSql();
+  await callTrail({ rank: 'xenos' });
+  const list = listSql().sql;
+  const count = countSql().sql;
+  // A Xenos must not be told there are N ideas when skill-friction rows are
+  // filtered out of the list they can see.
+  assert.ok(/title NOT LIKE/.test(list), 'the list applies the skill-friction gate for a Xenos');
+  assert.ok(/title NOT LIKE/.test(count), 'the count applies the SAME gate — a pill that disagrees with its rows is the classic bug');
+});
+
+await test('an out-of-range limit clamps instead of 400ing a profile mid-render', async () => {
+  resetSql();
+  await callTrail({ query: { limit: '9999' } });
+  const params = listSql().params;
+  assert.equal(params[params.length - 2], inbox.IDEA_TRAIL_DEFAULT_LIMIT);
+  resetSql();
+  await callTrail({ query: { limit: '50', offset: '100' } });
+  const p2 = listSql().params;
+  assert.equal(p2[p2.length - 2], 50);
+  assert.equal(p2[p2.length - 1], 100);
+});
+
+await test('a bad builder id is a 400, not a whole-table read', async () => {
+  resetSql();
+  const r = await callTrail({ params: { id: 'not-a-number' } });
+  assert.equal(r.status, 400);
+  assert.equal(queries.length, 0, 'nothing was queried');
+});
+
+// ---------------------------------------------------------------------------
+// 3. the lifecycle reads — the craft axis and the private-goal wall, in SQL
+// ---------------------------------------------------------------------------
+
+await test('tasks: no craft means the WHOLE record, unclassified included', async () => {
+  resetSql();
+  await activity.activityTasksByBuilder(95, {});
+  const sql = listSql().sql;
+  assert.ok(!/discipline/.test(sql.split('SELECT')[2] || sql.split('WHERE')[1] || ''), 'no discipline predicate when no craft is asked for');
+  assert.ok(/t\.shipped_by = \$1/.test(sql) && /t\.status = 'shipped'/.test(sql), 'completed means shipped by this builder');
+});
+
+await test('tasks: a craft filters on discipline, and the count filters the same way', async () => {
+  resetSql();
+  await activity.activityTasksByBuilder(95, { role: 'artist' });
+  assert.ok(/COALESCE\(t\.discipline, 'unclassified'\) = \$2/.test(listSql().sql), 'the page filters by craft');
+  assert.ok(/COALESCE\(t\.discipline, 'unclassified'\) = \$2/.test(countSql().sql), 'the count filters by craft too');
+  assert.equal(listSql().params[1], 'artist');
+});
+
+await test('tasks: an unknown craft reads as NO filter, not as an error', async () => {
+  resetSql();
+  await activity.activityTasksByBuilder(95, { role: 'wizard' });
+  assert.ok(!/discipline\) = \$2/.test(listSql().sql), 'a craft nobody has shows the whole record');
+  assert.equal(activity.normalizeCraft('wizard'), null);
+});
+
+await test('goals: a private goal is walled off in SQL, before the LIMIT', async () => {
+  resetSql();
+  await activity.activityGoalsByBuilder(95, { viewerId: 9, viewerIsArchon: false });
+  const sql = listSql().sql;
+  assert.ok(/g\.visibility = 'public'/.test(sql), 'public goals always');
+  assert.ok(/goal_members gm/.test(sql), 'a member sees their private goal');
+  assert.ok(/\$3::boolean/.test(sql), 'an Archon sees all of them');
+  const limitAt = sql.indexOf('LIMIT');
+  assert.ok(sql.indexOf("visibility = 'public'") < limitAt, 'the wall is inside the query, not a post-LIMIT thin');
+  assert.ok(/g\.visibility = 'public'/.test(countSql().sql), 'the count is walled identically or the total lies');
+});
+
+await test("goals: a goal's craft is what its TASKS carry — no discipline column on goals", async () => {
+  resetSql();
+  await activity.activityGoalsByBuilder(95, { role: 'engineer' });
+  const sql = listSql().sql;
+  assert.ok(/array_agg\(DISTINCT COALESCE\(t\.discipline/.test(sql), 'the craft set is derived from the tasks');
+  assert.ok(/= ANY\(c\.disciplines\)/.test(sql), 'the craft filter tests that derived set');
+  assert.ok(!/goals[^)]*\.discipline/.test(sql), 'goals are never given a discipline column');
+});
+
+await test('both reads clamp their page window', () => {
+  assert.equal(activity.clampLimit(0), activity.DEFAULT_LIMIT);
+  assert.equal(activity.clampLimit(10_000), activity.MAX_LIMIT);
+  assert.equal(activity.clampOffset(-5), 0);
+  assert.equal(activity.clampOffset(40), 40);
+});
+
+// ---------------------------------------------------------------------------
+// 3b. the per-person predicates have indexes to stand on
+//
+// Every idea read before this one was scoped to status + captured_at, and every
+// task read to version + status, so those are the columns migration 006/003
+// indexed. This task introduced three PER-PERSON predicates, each on a route a
+// signed-in builder hits repeatedly and each paired with a COUNT(*) that has no
+// LIMIT to escape through — unindexed, they sequentially scan a shared table on
+// every request (grader panel finding, efficiency worker). A static check,
+// because an index is invisible to a DB-free suite in every other way: it pins
+// that the migration exists and still names the columns the queries filter on.
+// ---------------------------------------------------------------------------
+
+const MIGRATIONS = fs.readdirSync(path.join(ROOT, 'migrations'))
+  .filter((f) => f.endsWith('.sql'))
+  .map((f) => fs.readFileSync(path.join(ROOT, 'migrations', f), 'utf8'))
+  .join('\n');
+
+await test('the idea trail has an index on (captured_by, captured_at)', () => {
+  assert.match(
+    MIGRATIONS,
+    /CREATE INDEX[^;]*ON idea_inbox \(captured_by, captured_at DESC\)/i,
+    'the trail filters captured_by and orders captured_at — equality leads, sort trails'
+  );
+});
+
+await test('the works half has an index its shipped-only predicate can use', () => {
+  assert.match(
+    MIGRATIONS,
+    /CREATE INDEX[^;]*ON tasks \(shipped_by, shipped_at DESC\) WHERE status = 'shipped'/i,
+    "core_193's index on shipped_by is partial on `WHERE needs_rebase` and cannot serve this"
+  );
+});
+
+await test('the goals rollup has an index on tasks.goal_id', () => {
+  assert.match(MIGRATIONS, /CREATE INDEX[^;]*ON tasks \(goal_id\)/i);
+});
+
+// ---------------------------------------------------------------------------
+// 4. the core route — the gate, the 404, and the section switch
+// ---------------------------------------------------------------------------
+
+const authPath = require.resolve('../src/bongos/auth.js');
+let authedBuilder = { id: 9, rank: 'metic' };
+require.cache[authPath] = {
+  id: authPath,
+  filename: authPath,
+  loaded: true,
+  exports: {
+    requireBuilder: (req, res, next) => {
+      if (!authedBuilder) return res.fail('unauthorized', 401);
+      req.builder = authedBuilder;
+      return next();
+    },
+    requireRank: () => (_req, _res, next) => next(),
+    requirePermission: () => (_req, _res, next) => next(),
+  },
+};
+
+const dbPath = require.resolve('../src/bongos/db.js');
+require.cache[dbPath] = {
+  id: dbPath,
+  filename: dbPath,
+  loaded: true,
+  exports: {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    getBuilderById: async (id) => (Number(id) === 95 ? { id: 95, github_login: 'jaxri' } : null),
+  },
+};
+
+const seams = require('../src/module-seams.js');
+seams._reset();
+let portCalls = [];
+seams.registerProvider('lifecycle', {
+  countShippedTasksForBuilder: async () => 3,
+  recentShippedTasksByBuilder: async () => [],
+  activityTasksByBuilder: async (id, opts) => {
+    portCalls.push(['tasks', id, opts]);
+    return { rows: [{ id: 42, title: 'A work', discipline: 'engineer' }], total: 1 };
+  },
+  activityGoalsByBuilder: async (id, opts) => {
+    portCalls.push(['goals', id, opts]);
+    return { rows: [{ id: 7, title: 'A goal', disciplines: ['artist'] }], total: 1 };
+  },
+});
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildBuildersRouter = require('../src/bongos/routes/builders.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildBuildersRouter());
+const http = await import('node:http');
+const server = await new Promise((resolve) => {
+  const s = app.listen(0, '127.0.0.1', () => resolve(s));
+});
+const port = server.address().port;
+
+function get(pathStr) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: pathStr }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* not json */ }
+        resolve({ status: res.statusCode, json, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+await test('the activity route is GATED — the public profile beside it is not', async () => {
+  portCalls = [];
+  authedBuilder = null;
+  const r = await get('/api/gds/builders/95/activity');
+  assert.equal(r.status, 401);
+  assert.equal(portCalls.length, 0, 'no read happened');
+  authedBuilder = { id: 9, rank: 'metic' };
+});
+
+await test('section defaults to tasks and role rides through to the port', async () => {
+  portCalls = [];
+  const r = await get('/api/gds/builders/95/activity?role=artist');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.section, 'tasks');
+  assert.equal(r.json.role, 'artist');
+  assert.equal(r.json.total, 1);
+  assert.equal(portCalls[0][0], 'tasks');
+  assert.equal(portCalls[0][2].role, 'artist');
+});
+
+await test('section=goals carries the VIEWER, because private goals depend on who asks', async () => {
+  portCalls = [];
+  authedBuilder = { id: 9, rank: 'archon' };
+  const r = await get('/api/gds/builders/95/activity?section=goals');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.section, 'goals');
+  assert.equal(portCalls[0][0], 'goals');
+  assert.equal(portCalls[0][2].viewerId, 9);
+  assert.equal(portCalls[0][2].viewerIsArchon, true);
+  authedBuilder = { id: 9, rank: 'metic' };
+});
+
+await test('a viewer-dependent read is never cached', async () => {
+  const r = await get('/api/gds/builders/95/activity');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
+await test('an unknown builder is a 404 and a bad id a 400', async () => {
+  assert.equal((await get('/api/gds/builders/9999/activity')).status, 404);
+  assert.equal((await get('/api/gds/builders/abc/activity')).status, 400);
+});
+
+server.close();
+
+// ---------------------------------------------------------------------------
+// 5. the kit's server-offset pager mode
+// ---------------------------------------------------------------------------
+
+globalThis.document = { getElementById: () => null };
+const OTBKit = require('../modules/hall-ui/public/hall-kit.js');
+
+await test('pageOffset turns a page number into the offset a server takes', () => {
+  const p = OTBKit.makePager('x', 'k', { defaultPerPage: 10 });
+  assert.equal(OTBKit.pageOffset(p), 0);
+  p.page = 3;
+  assert.equal(OTBKit.pageOffset(p), 20);
+});
+
+await test('renderServerPage clamps a page that outran a shrunken set, and says it did', () => {
+  const p = OTBKit.makePager('x', 'k', { defaultPerPage: 10 });
+  p.page = 9;
+  assert.equal(OTBKit.renderServerPage(p, 15, 0), true, 'reports the clamp so the caller refetches');
+  assert.equal(p.page, 2);
+  assert.equal(OTBKit.renderServerPage(p, 15, 5), false, 'an in-range page is left alone');
+});
+
+await test('a ledger cannot be both client-sliced and server-paged', () => {
+  const p = OTBKit.makePager('x', 'k', {});
+  assert.throws(
+    () => OTBKit.makeLedger({ mount: {}, rowHtml: () => '', pager: p, serverPager: p }),
+    /not both/
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 6. the page — the four outcomes, the craft axis, and the signed-out state
+// ---------------------------------------------------------------------------
+
+const PROFILE_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
+
+// The four outcomes the criterion names, one row each. `open` is included
+// precisely because it must read as an outcome and not as an absence.
+const TRAIL = [
+  {
+    id: '901', title: 'A shared changelog', status: 'promoted', captured_at: '2026-08-01T00:00:00Z',
+    promoted_to_task_id: '1003281', promoted_task_title: 'See what you did, by role',
+    lineage_tasks: [{ task_id: '1003281', origin: 'promote', title: 'See what you did, by role', status: 'shipped' }],
+  },
+  { id: '902', title: 'A second thought', status: 'discarded', captured_at: '2026-07-01T00:00:00Z', triage_note: 'Covered by goal 1000072.' },
+  { id: '903', title: 'A duplicate', status: 'merged', captured_at: '2026-06-01T00:00:00Z', merged_into_idea_id: '901', merged_into_idea_title: 'A shared changelog' },
+  { id: '904', title: 'Still thinking', status: 'open', captured_at: '2026-05-01T00:00:00Z' },
+];
+
+// Boot the REAL profile.js against a stub DOM + a stub OTBKit that captures each
+// ledger's rowHtml, and return what it rendered plus every request it made.
+function bootProfile({ signedIn = true } = {}) {
+  const els = new Map();
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    addEventListener() {},
+    querySelector() { return makeEl(); }, querySelectorAll() { return []; }, appendChild() {},
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    title: '',
+    body: { dataset: { page: 'profile' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelector(sel) { return this.getElementById(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  const client = {
+    request: async (method, url) => {
+      requests.push(url);
+      if (url.endsWith('/me')) {
+        return signedIn
+          ? { status: 200, ok: true, data: { builder: { id: 95, rank: 'metic' } } }
+          : { status: 401, ok: false, data: null };
+      }
+      if (/\/builders\/\d+\/profile$/.test(url)) {
+        return { status: 200, ok: true, data: { builder: { id: 95, github_login: 'jaxri', rank: 'metic' }, shipped_count: 4, achievements: [], recent_ships: [] } };
+      }
+      if (url.includes('/activity?')) {
+        const isGoals = url.includes('section=goals');
+        return { status: 200, ok: true, data: { rows: isGoals ? [{ id: 7, title: 'A goal', disciplines: ['artist'], task_shipped: 1, task_total: 2 }] : [{ id: 42, title: 'A work', discipline: 'engineer', shipped_at: '2026-08-01T00:00:00Z' }], total: 1 } };
+      }
+      if (url.includes('/inbox/by-builder/')) {
+        return { status: 200, ok: true, data: { ideas: TRAIL, total: TRAIL.length } };
+      }
+      return { status: 404, ok: false, data: null };
+    },
+  };
+
+  // The captured ledgers, keyed by the mount element they were given.
+  const ledgers = new Map();
+  let tabsOnChange = null;
+  const kit = {
+    makePager: (prefix, key, opts = {}) => ({
+      prefix, key, page: 1, perPage: opts.defaultPerPage || 25,
+      perPageOptions: [10, 25], minPerPage: opts.minPerPage ?? 10,
+    }),
+    pageOffset: (p) => Math.max(0, (p.page - 1) * p.perPage),
+    makeLedger: ({ mount, rowHtml }) => {
+      const rec = { rows: [], total: 0, html: '' };
+      const ledger = {
+        render(rows, opts = {}) {
+          rec.rows = rows || [];
+          rec.total = opts.total || 0;
+          rec.html = rec.rows.map((r, i) => rowHtml(r, i)).join('');
+        },
+      };
+      ledgers.set(mount, rec);
+      return ledger;
+    },
+    makeTabs: ({ tabs, onChange }) => {
+      let current = tabs[0].id;
+      tabsOnChange = onChange;
+      onChange(current);
+      return { active: () => current, activate(id) { current = id; onChange(id); } };
+    },
+    shipVisualThumbHtml: () => '',
+  };
+
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => client },
+    OTBKit: kit,
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtNum: (n) => String(n ?? 0),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      rankLabel: (r) => r,
+      toast() {},
+    },
+    location: { hostname: 'builders.cloudbongos.com', search: '', pathname: '/profile' },
+    localStorage: { getItem: () => null, setItem() {} },
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console, setTimeout, clearTimeout, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(PROFILE_JS, sandbox, { filename: 'profile.js' });
+
+  const htmlFor = (mountId) => {
+    const rec = ledgers.get(documentObj.getElementById(mountId));
+    return rec ? rec.html : null;
+  };
+  return {
+    requests,
+    htmlFor,
+    switchCraft: (id) => { if (tabsOnChange) tabsOnChange(id); },
+    el: (id) => documentObj.getElementById(id),
+  };
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 0));
+
+await test('the ideator view shows EVERY idea filed, whatever became of it', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  const html = p.htmlFor('activity-ideas');
+  assert.ok(html, 'the idea trail rendered');
+  for (const idea of TRAIL) {
+    assert.ok(html.includes(idea.title), `"${idea.title}" (${idea.status}) is in the trail`);
+  }
+});
+
+await test('a promotion links THROUGH to the task it produced — the done-when click', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  const html = p.htmlFor('activity-ideas');
+  assert.ok(html.includes('/task/1003281'), 'the promoted task is a link, not a bare number');
+  assert.ok(html.includes('See what you did, by role'), 'and it is named, so the reader need not go look it up');
+});
+
+await test('the other three outcomes each say what happened', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  const html = p.htmlFor('activity-ideas');
+  assert.ok(/Discarded/.test(html), 'a discarded idea says so');
+  assert.ok(html.includes('Covered by goal 1000072.'), "and carries the triager's reason");
+  assert.ok(/Merged into/.test(html) && html.includes('/idea/901'), 'a merge links to the idea that absorbed it');
+  assert.ok(/Still open/.test(html), 'AN OPEN IDEA READS AS OPEN — not as nothing');
+});
+
+await test('switching craft re-asks the SERVER — it does not filter a page in the browser', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  const before = p.requests.length;
+  p.switchCraft('artist');
+  await settle(); await settle();
+  const after = p.requests.slice(before);
+  assert.ok(after.some((u) => u.includes('section=tasks') && u.includes('role=artist')), 'tasks are re-fetched for the craft');
+  assert.ok(after.some((u) => u.includes('section=goals') && u.includes('role=artist')), 'goals are re-fetched for the craft');
+});
+
+await test('the idea trail belongs to the ideator view, not to every craft', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  assert.equal(p.el('activity-ideas-panel').hidden, false, 'the default "all" view is the whole record, trail included');
+  p.switchCraft('engineer');
+  await settle();
+  assert.equal(p.el('activity-ideas-panel').hidden, true, 'an engineer view is engineer work');
+  p.switchCraft('ideator');
+  await settle();
+  assert.equal(p.el('activity-ideas-panel').hidden, false, 'filing an idea IS ideator work');
+});
+
+await test('the ledgers page server-side — the request carries a window, not the whole record', async () => {
+  const p = bootProfile();
+  await settle(); await settle(); await settle();
+  const tasksReq = p.requests.find((u) => u.includes('section=tasks'));
+  assert.ok(/limit=\d+/.test(tasksReq) && /offset=\d+/.test(tasksReq), 'limit + offset ride on every activity request');
+  const trailReq = p.requests.find((u) => u.includes('/inbox/by-builder/'));
+  assert.ok(/limit=\d+/.test(trailReq) && /offset=\d+/.test(trailReq), 'so does the trail — "every idea" can be a long list');
+});
+
+await test('signed out: the section says why, and asks the server for nothing', async () => {
+  const p = bootProfile({ signedIn: false });
+  await settle(); await settle(); await settle();
+  assert.ok(!p.requests.some((u) => u.includes('/activity')), 'no activity read');
+  assert.ok(!p.requests.some((u) => u.includes('/inbox/by-builder/')), 'no trail read');
+});
+
+// ---------------------------------------------------------------------------
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);