@bongos/core 1.19.484 → 1.19.486

package/src/bongos/project-settings.js

@@ -0,0 +1,193 @@
+'use strict';
+
+// src/bongos/project-settings.js — the instance's live, DB-backed knobs, and the
+// typed accessor every reader goes through (task 1003279, goal 1000072).
+//
+// WHY THIS FILE EXISTS. Goal 1000072's rotting half needs a number — "untouched
+// for how long?" — and task 1003280 states where it must live: "STALE TIMER —
+// live, DB-backed", followed by "do not fork a second store". A knob an owner can
+// change from a page cannot be an env var that needs a redeploy, and it must not
+// become a THIRD place staleness is configured. So there is one table
+// (project_settings, migration core_231) and one accessor, here.
+//
+// HOW THIS RELATES TO src/stale-timer.js — READ THIS BEFORE ADDING A THIRD TIMER.
+// ADR 0226 collapsed four disagreeing answers to "how long may a CLAIM go silent"
+// into one resolver. This file does not reopen that. The two timers measure
+// different things, are owned by different surfaces, and have different
+// consequences:
+//
+//   src/stale-timer.js   a CLAIM goes silent      hours   env    the sweep RELEASES it
+//   this file            work goes UNTOUCHED      days    DB     a human is ASKED
+//
+// The distinction that keeps them from collapsing into each other: the claim timer
+// is about a builder who stopped responding, and the machine acts alone. The rot
+// timer is about work nobody picked up, and the machine only ever raises a
+// question. One enforces, one reports — which is exactly the asymmetry ADR 0226's
+// header names, applied one level up.
+//
+// This is why the rot read deliberately EXCLUDES tasks at 'active': a claimed task
+// that has gone quiet is the claim timer's question, and reporting it here too
+// would put the same rot in two inboxes with two different numbers — the precise
+// failure ADR 0226 exists to prevent.
+//
+// FAIL POSTURE: REPORTING, SO IT DEGRADES. Every caller of this file is a read
+// surface (the needs-attention inbox, the settings page). A knob typed wrong shows
+// up ON the screen of the person who can fix it, labelled, instead of 500-ing the
+// inbox they were using to find the problem. Nothing here throws on a bad value;
+// it reports one. (An enforcing caller would have to refuse instead — see the
+// stale-timer header. There is no enforcing caller of the rot timer, by design.)
+
+const { pool } = require('./pool');
+// The structured logger rather than console.* — both are kernel files (this one is on
+// fitness.js's KERNEL_FILES roster), a structured line is attributable and rides
+// ADR 0022's redaction, and the quality ratchet counts bare console calls.
+const { logger } = require('./logger');
+
+// The knob names. Namespaced by the surface that owns them so a settings page can
+// group rows without a second column, and so a future knob from another surface
+// cannot collide with this one.
+const SETTING_KEYS = {
+  ROT_DAYS: 'attention.rot_days',
+};
+
+// The last-resort rot timer, in days. 30 because that is the shortest window in
+// which "nobody has touched this" is evidence of rot rather than evidence of a
+// normal week — a fortnight would fire on every ordinary holiday, and a quarter is
+// long enough that the backlog has already stopped being read.
+const DEFAULT_ROT_DAYS = 30;
+
+// The accepted range, in days. 1 because "yesterday" is the shortest question worth
+// asking. 365 because past a year the timer is an off switch, and an off switch
+// should be asked for out loud rather than typed as a big number — the same
+// reasoning, and the same sentence, as the 720h bound in src/stale-timer.js.
+const MIN_ROT_DAYS = 1;
+const MAX_ROT_DAYS = 365;
+
+// Parse one candidate into whole days, or say why it is unusable. Pure, never
+// throws: both the DB tier and the override tier want to decide for themselves what
+// an unusable value means. Mirrors parseHours in src/stale-timer.js deliberately —
+// two timers with two different range checks would drift into two different ideas
+// of what "valid" means.
+function parseDays(raw) {
+  if (raw == null || raw === '') return { reason: 'empty' };
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return { reason: 'not a number' };
+  if (!Number.isInteger(n)) return { reason: 'must be a whole number of days' };
+  if (n <= 0) return { reason: 'must be positive' };
+  if (n < MIN_ROT_DAYS || n > MAX_ROT_DAYS) {
+    return { reason: `out of range (${MIN_ROT_DAYS}..${MAX_ROT_DAYS})` };
+  }
+  return { days: n };
+}
+
+// getSetting(key) — the raw row, or null when the key has never been set.
+// NULL IS MEANINGFUL: absence means "never configured, use the code default", which
+// is what lets a fresh instance boot with an empty table and what lets the settings
+// page tell "never touched" apart from "deliberately set to the default value".
+// Never seed a default row to avoid the null.
+async function getSetting(key) {
+  const { rows } = await pool.query(
+    'SELECT key, value, updated_at, updated_by FROM project_settings WHERE key = $1',
+    [key]
+  );
+  return rows[0] || null;
+}
+
+// setSetting(key, value, builderId) — upsert one knob, returning the stored row.
+// The value is stored verbatim as text and validated by the typed resolver at READ
+// time, not here, so a value that was valid when written and later fell outside a
+// tightened range degrades on the screen rather than becoming unreadable.
+// builderId may be null for a system path with no builder in the request.
+async function setSetting(key, value, builderId = null) {
+  const { rows } = await pool.query(
+    `INSERT INTO project_settings (key, value, updated_by, updated_at)
+          VALUES ($1, $2, $3, now())
+     ON CONFLICT (key) DO UPDATE
+            SET value = EXCLUDED.value,
+                updated_by = EXCLUDED.updated_by,
+                updated_at = now()
+      RETURNING key, value, updated_at, updated_by`,
+    [key, String(value), builderId]
+  );
+  return rows[0];
+}
+
+// resolveRotDays({ override }) — the project's rot timer and where the number came
+// from, for any surface that reports staleness.
+//
+// Precedence, widest-scope last (the same shape as resolveStaleClaimHours):
+//   1. override — a per-request lens (?rot_days=). Someone asking "what would 7
+//                 days show me?" is not reconfiguring the project, so this never
+//                 becomes the project's answer and is never written back.
+//   2. the DB   — project_settings['attention.rot_days']. THIS is the project's
+//                 configured timer, the row task 1003280's page writes.
+//   3. default  — DEFAULT_ROT_DAYS.
+//
+// Returns { days, source, invalid }:
+//   days    — always a usable positive integer, whatever went wrong
+//   source  — 'override' | 'project_settings' | 'default'
+//   invalid — null, or { where, raw, reason }: something was SET and unusable.
+//             `days` has already fallen through to the next tier; a reporting
+//             caller should say so on screen.
+//
+// A DB that is unreachable is NOT an invalid value — it is a failure to read, and
+// this returns the default with source 'default' rather than taking the inbox down.
+// The inbox is how someone would notice the database is unhappy.
+async function resolveRotDays({ override } = {}) {
+  if (override != null && override !== '') {
+    const got = parseDays(override);
+    if (got.days != null) return { days: got.days, source: 'override', invalid: null };
+    return {
+      days: DEFAULT_ROT_DAYS,
+      source: 'default',
+      invalid: { where: 'override', raw: String(override), reason: got.reason },
+    };
+  }
+
+  let row = null;
+  try {
+    row = await getSetting(SETTING_KEYS.ROT_DAYS);
+  } catch (err) {
+    logger.error(`project_settings read failed; falling back to the default rot timer: ${err && err.message}`);
+    return { days: DEFAULT_ROT_DAYS, source: 'default', invalid: null };
+  }
+
+  if (row && row.value != null && row.value !== '') {
+    const got = parseDays(row.value);
+    if (got.days != null) return { days: got.days, source: 'project_settings', invalid: null };
+    return {
+      days: DEFAULT_ROT_DAYS,
+      source: 'default',
+      invalid: { where: `project_settings['${SETTING_KEYS.ROT_DAYS}']`, raw: String(row.value), reason: got.reason },
+    };
+  }
+
+  return { days: DEFAULT_ROT_DAYS, source: 'default', invalid: null };
+}
+
+// describeRotTimer(resolved) — one sentence naming the timer and its provenance, for
+// an API receipt or a settings row. A number with no provenance is what let a 6h and
+// a 24h coexist unnoticed for months (ADR 0226); every surface that prints the rot
+// timer prints this instead of printing the bare number.
+function describeRotTimer(resolved) {
+  const r = resolved || {};
+  const base = `${r.days}d (${r.source})`;
+  if (!r.invalid) return base;
+  return `${base} — ignoring ${r.invalid.where}="${r.invalid.raw}" (${r.invalid.reason})`;
+}
+
+// parseDays is exported for the tests only — the range check and the default are
+// asserted against the SAME constants the resolver reads, because a test that
+// re-typed 30 or 365 would be the second copy of the number this file exists to
+// keep singular.
+module.exports = {
+  SETTING_KEYS,
+  DEFAULT_ROT_DAYS,
+  MIN_ROT_DAYS,
+  MAX_ROT_DAYS,
+  parseDays,
+  getSetting,
+  setSetting,
+  resolveRotDays,
+  describeRotTimer,
+};

package/src/module-api.js

@@ -17,6 +17,17 @@ const { pool, instanceDbName } = require('./bongos/pool');
 const branding = require('./branding');
 const instanceConfig = require('./instance-config');
 const staleTimer = require('./stale-timer');
+// Destructured, not namespaced, deliberately — the same form src/bongos/routes/
+// builders.js uses for stale-timer.js. knip attributes a named export to a
+// destructured binding but not to a property read off a required namespace, so the
+// namespace form reports every export here as dead and regresses the ratchet.
+const {
+  resolveRotDays,
+  SETTING_KEYS: PROJECT_SETTING_KEYS,
+  getSetting: getProjectSetting,
+  setSetting: setProjectSetting,
+  describeRotTimer,
+} = require('./bongos/project-settings');
 const seams = require('./module-seams');
 const { buildInfo } = require('./build-info');
 const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePagination, pageMeta, PAGINATION } = require('./bongos/routes/_helpers');
@@ -34,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.484'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.486'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -250,6 +261,23 @@ module.exports = {
   //     a direct require in scripts/ rather than joining the published surface.
   resolveStaleClaimHours: staleTimer.resolveStaleClaimHours,
   staleClaimMinutes: staleTimer.staleClaimMinutes,
+  // --- the project's ROT TIMER + the knob store behind it (task 1003279, goal
+  //     1000072) — how long a GOAL or TASK may go untouched before the hall's
+  //     needs-attention inbox raises a line about it. A DIFFERENT question from the
+  //     stale-claim timer directly above, and the two must not be confused: that one
+  //     counts hours, is read from the env, is about a builder who went quiet, and
+  //     the sweeper ACTS on it alone. This one counts days, is read from the DB
+  //     (task 1003280 puts it on a settings page, and "do not fork a second store"),
+  //     is about work nobody picked up, and it only ever ASKS a human. The rot read
+  //     deliberately skips tasks at 'active' so the two never report the same rot
+  //     with two different numbers. See src/bongos/project-settings.js.
+  resolveRotDays,
+  projectSettings: {
+    KEYS: PROJECT_SETTING_KEYS,
+    get: getProjectSetting,
+    set: setProjectSetting,
+    describeRotTimer,
+  },
   readConfigFileSync: instanceConfig.readConfigFileSync,
   configHome: instanceConfig.configHome,
   configPath: instanceConfig.configPath,

package/tests/hall_settings_world.mjs

@@ -0,0 +1,274 @@
+// tests/hall_settings_world.mjs — the PANEL family in the chrome world
+// (task 1003308, goal 1000081): settings, profile, pair, not-ready.
+//
+// tests/hall_tokens.mjs pins the TIER these pages spend; this pins how they
+// spend it. Everything here is a fact that is silent in a browser: the page
+// still renders, it just renders wrong, or it renders right on one machine and
+// fails a floor on the reviewer's. Each assertion is something the redesign
+// measured and would otherwise have to re-measure by hand every time.
+//
+// What it locks:
+//   * ONE ARCHETYPE SHEET. panel.css holds the row, the switch, the field, the
+//     chip control and the family's voices; the four page sheets hold only what
+//     one page has. Every page links panel.css BEFORE its own sheet.
+//   * THE ONE h1. None of the five had one — the hall predates the floor — so
+//     every render failed one-header-main-h1. The h1 is the page's name in the
+//     room voice, and it lives in the static markup so the DOM has it in every
+//     state, not only the happy path.
+//   * THE SWITCH IS A SWITCH. A toggle is role=switch with aria-checked, drawn
+//     as a 44x24 track inside a 46x38 target; the page scripts keep reading
+//     data-on, which they wrote. The wandering pick is a radio row, not four
+//     "Choose" buttons.
+//   * THE 24px FLOOR ON BOTH AXES. .craft-pref was 13x13 — the smallest control
+//     in the hall; .profile__disc-edit (123x19) and .profile__needs-act (18px)
+//     on the Standing card belonged to this family and are bought up with the
+//     prose-link recipe.
+//   * WHITE ON THE ACCENT, AND THE ONE EXCEPTION. Eight literals across three
+//     sheets are gone; the Discord blurple pair stays, because it is Discord's
+//     mark and not the world's, and it is named as the exception in a comment.
+//   * THE COMPAT ALIASES. Five sheets, zero aliases spent.
+//
+// Reproduce the renders these came from (the family needs the fixture harness —
+// every panel is filled from /me/* reads the kit stub does not carry):
+//   node scripts/hall-preview/server.js --port 4621 --fixture-me
+//   node modules/ui-design/kit/render.js --states modules/hall-ui/public/settings.states.json \
+//     --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621
+//   (and profile / pair / not-ready .states.json the same way)
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, '');
+
+const PAGES = ['settings', 'profile', 'pair', 'not-ready'];
+const SHEETS = ['panel.css', 'settings.css', 'pair.css', 'profile.css'];
+
+const panelCss = read('panel.css');
+const settingsCss = read('settings.css');
+const styleCss = read('style.css');
+const settingsJs = read('settings.js');
+
+// The body of the first rule whose selector LIST contains `selector` as one of
+// its comma-separated members — the family sheet groups the page scripts' own
+// names onto one rule, so a rule is found by membership, not by a bare prefix.
+function ruleOf(css, selector) {
+  // an @media wrapper is unwrapped so the rules inside it scan as flat rules;
+  // the FIRST match wins, which is the unwrapped one for a selector that also
+  // has a breakpoint override
+  const bare = stripComments(css).replace(/@media[^{]*\{/g, '');
+  // a lookbehind, not a consuming group: a consumed `}` would hide every other rule
+  const re = /(?<=^|[}])\s*([^{}]+?)\s*\{([^}]*)\}/g;
+  let m;
+  while ((m = re.exec(bare))) {
+    const members = m[1].split(',').map((s) => s.trim());
+    if (members.includes(selector)) return m[2];
+  }
+  return null;
+}
+
+// ---- 1. one archetype sheet, linked before the page's own -------------------
+
+test('every page in the family links panel.css before its own sheet', () => {
+  for (const p of PAGES) {
+    const html = read(`${p}.html`);
+    const links = [...html.matchAll(/<link rel="stylesheet" href="\/builders\/([a-z-]+\.css)[^"]*">/g)].map((x) => x[1]);
+    const at = links.indexOf('panel.css');
+    assert.ok(at > -1, `${p}.html links panel.css`);
+    assert.ok(links.indexOf('style.css') < at, `${p}.html: the shell first, then the archetype`);
+    const own = `${p}.css`;
+    if (links.includes(own)) assert.ok(links.indexOf(own) > at, `${p}.html: the page sheet after the archetype`);
+  }
+  assert.ok(read('profile.html').includes('/builders/profile.css'), 'the profile has a sheet of its own now');
+});
+
+test('the archetype holds the row, the switch, the field and the voices; the page sheets do not redefine them', () => {
+  for (const sel of ['.prow', '.sw', '.sw__track', '.sw__knob', '.field-label', '.pinput', '.chip-ctl', '.panel-note', '.panel-status', '.gate']) {
+    assert.ok(ruleOf(panelCss, sel), `panel.css defines ${sel}`);
+  }
+  for (const sheet of ['settings.css', 'pair.css', 'profile.css']) {
+    const css = read(sheet);
+    for (const sel of ['.prow', '.sw', '.sw__track', '.pinput', '.chip-ctl']) {
+      assert.equal(ruleOf(css, sel), null, `${sheet} must not redefine ${sel} — that is how the family would drift`);
+    }
+  }
+});
+
+// ---- 2. the one h1, in the static markup ----------------------------------
+
+test('each of the five pages has exactly one h1, in the family\'s page head', () => {
+  for (const p of PAGES) {
+    const html = read(`${p}.html`).replace(/<!--[\s\S]*?-->/g, '');
+    const h1s = html.match(/<h1\b/g) || [];
+    assert.equal(h1s.length, 1, `${p}.html: one-header-main-h1 — the page had none until task 1003308`);
+    assert.match(html, /<div class="page-head page-head--room page-head--panel">\s*(<p class="page-head__eyebrow">[^<]*<\/p>\s*)?<h1 id="[a-z-]+-h1" class="page-head__h">/,
+      `${p}.html: the h1 is the page's name in the room voice, static so every state has it`);
+  }
+  assert.match(ruleOf(panelCss, '.page-head--room.page-head--panel') || '', /padding-top:\s*0/,
+    'the family takes the room VOICE, not its top air — a form page starts at the content edge');
+});
+
+// ---- 3. the switch, the radio, the chip: the 24px floor on both axes -------
+
+test('a toggle is a role=switch with aria-checked, and the page script keeps data-on', () => {
+  assert.match(settingsJs, /function switchHtml\(/, 'one switch builder');
+  const fn = settingsJs.match(/function switchHtml\([\s\S]*?\n  \}\n/);
+  assert.ok(fn, 'switchHtml is a whole function');
+  assert.match(fn[0], /role="switch"/, 'role=switch');
+  assert.match(fn[0], /aria-checked="\$\{on \? 'true' : 'false'\}"/, 'state is aria-checked');
+  assert.match(fn[0], /data-on="\$\{on \? '1' : '0'\}"/, 'and data-on stays, because every delegated click handler reads it');
+  assert.match(fn[0], /sw__track[\s\S]*sw__knob/, 'drawn as a track and a knob');
+  assert.doesNotMatch(settingsJs, /aria-pressed/, 'no aria-pressed toggles are left on the page');
+  for (const fnName of ['renderSounds', 'renderRender', 'renderCrossProject', 'privacyRow']) {
+    const body = settingsJs.match(new RegExp(`function ${fnName}\\([\\s\\S]*?\\n  \\}\\n`));
+    assert.ok(body && /switchHtml\(/.test(body[0]), `${fnName} renders the switch`);
+  }
+});
+
+test('the switch clears the floor: a 46x38 target drawing a 44x24 track', () => {
+  const sw = ruleOf(panelCss, '.sw');
+  assert.ok(sw, '.sw has a rule');
+  assert.match(sw, /width:\s*46px/, 'the target is 46 wide');
+  assert.match(sw, /height:\s*38px/, 'and 38 tall — this is what the floor measures');
+  const track = ruleOf(panelCss, '.sw__track');
+  assert.match(track, /width:\s*44px/, 'the drawn track stays the world\'s small shape');
+  assert.match(track, /height:\s*24px/);
+  const on = ruleOf(panelCss, '.sw[aria-checked="true"] .sw__track');
+  assert.match(on, /background:\s*var\(--accent-tint\)/, 'on is the tint, the accent arrives on the knob');
+});
+
+test('the wandering pick is a radio row, wired on change', () => {
+  const render = settingsJs.match(/function renderWandering\([\s\S]*?\n  \}\n/);
+  assert.ok(render, 'renderWandering is a whole function');
+  assert.match(render[0], /<label class="prow prow--pick" for="\$\{id\}"/, 'the whole row is the radio\'s label');
+  assert.match(render[0], /<input class="pradio" type="radio" name="wandering"/, 'a real radio group');
+  assert.match(render[0], /locked \? ' disabled' : ''/, 'a level above the rank ceiling is a disabled radio');
+  assert.doesNotMatch(render[0], /Rank-locked<\/button>|Choose<\/button>/, 'the four "Choose" buttons are gone');
+  const load = settingsJs.match(/async function loadWandering\([\s\S]*?\n  \}\n/);
+  assert.match(load[0], /addEventListener\('change'/, 'a radio fires change, not click');
+  assert.match(load[0], /closest\('\.pradio'\)/);
+  const radio = ruleOf(panelCss, '.pradio');
+  assert.match(radio, /width:\s*24px/);
+  assert.match(radio, /height:\s*24px/, 'a native radio is 13px; the floor is 24');
+});
+
+test('.craft-pref is a 24px target with a 14px drawn box — it was 13x13, the smallest control in the hall', () => {
+  const box = ruleOf(panelCss, '.craft-pref');
+  assert.ok(box, '.craft-pref has a rule');
+  assert.match(box, /width:\s*24px/);
+  assert.match(box, /height:\s*24px/);
+  assert.match(box, /appearance:\s*none/, 'the native box has to go, or sizing it up sizes the glyph up too');
+  const before = ruleOf(panelCss, '.craft-pref::before');
+  assert.match(before, /width:\s*14px/, 'the drawn box stays 14px inside the 24px target');
+  const check = ruleOf(panelCss, '.craft-pref:checked::after');
+  assert.match(check, /border:\s*solid var\(--accent-on\)/, 'the tick is the dark ink on the salmon, never white');
+});
+
+test('the Standing card\'s two under-floor links buy both axes and hand the room back', () => {
+  for (const sel of ['.profile__disc-edit', '.profile__needs-act']) {
+    const r = ruleOf(styleCss, sel);
+    assert.ok(r, `${sel} has a rule`);
+    assert.match(r, /display:\s*inline-block/, `${sel}: inline-block, so min-height applies to a run of text`);
+    assert.match(r, /min-height:\s*24px/, `${sel}: the height half of the floor (it measured 19px and 18px)`);
+    assert.match(r, /min-width:\s*24px/, `${sel}: the width half`);
+    assert.match(r, /padding:\s*3px 4px/, `${sel}: the row recipe`);
+    assert.match(r, /margin:\s*-3px -4px/, `${sel}: the negative margin gives the padding back to the line`);
+  }
+});
+
+// ---- 4. the world's own bans -------------------------------------------------
+
+test('no sheet in the family spends a compat alias', () => {
+  const aliases = ['--surface', '--surface-2', '--border', '--border-strong', '--accent-weak', '--accent-text'];
+  for (const sheet of SHEETS) {
+    const bare = stripComments(read(sheet));
+    const spent = aliases.filter((a) => new RegExp(`var\\(\\s*${a}\\s*[,)]`).test(bare));
+    assert.deepEqual(spent, [], `${sheet}: the aliases exist for un-reskinned pages, so spending one here opts the sheet out of the world`);
+  }
+});
+
+test('white on the accent is gone, and the Discord mark is the one named exception', () => {
+  for (const sheet of ['panel.css', 'pair.css', 'profile.css']) {
+    const bare = stripComments(read(sheet));
+    assert.doesNotMatch(bare, /#[0-9a-f]{3,8}\b/i, `${sheet} carries no colour literal`);
+    assert.doesNotMatch(bare, /:\s*white\b/i, `${sheet} carries no named white`);
+  }
+  const bare = stripComments(settingsCss);
+  const literals = [...bare.matchAll(/#[0-9a-f]{3,8}\b/gi)].map((m) => m[0].toLowerCase());
+  assert.deepEqual([...new Set(literals)].sort(), ['#4853c4', '#5865f2', '#ffffff'],
+    'settings.css: the blurple pair and its white are the only literals, and they are Discord\'s');
+  for (const lit of literals) {
+    // every literal sits inside a .settings-btn--discord rule
+    const idx = bare.indexOf(lit);
+    const ruleStart = bare.lastIndexOf('{', idx);
+    const selector = bare.slice(bare.lastIndexOf('}', ruleStart) + 1, ruleStart);
+    assert.match(selector, /\.settings-btn--discord/, `${lit} is spent only on the Discord button`);
+  }
+  assert.match(settingsCss, /THIRD-PARTY MARK, KEPT ON PURPOSE/, 'the exception is named in a comment so a literal sweep leaves it alone');
+  // the save/accent buttons take --accent-on. `.pair-approve` and `.craft-save`
+  // are members of the base pill rule AND the save rule, so the save rule is
+  // found by its own name and the two are asserted as its members.
+  const save = ruleOf(panelCss, '.pbtn--save');
+  assert.ok(save, '.pbtn--save has a rule');
+  assert.match(save, /background:\s*var\(--accent\)/);
+  assert.match(save, /color:\s*var\(--accent-on\)/, 'the dark ink for the salmon — white on it fails AA');
+  const saveSelector = stripComments(panelCss).match(/([^{}]*\.pbtn--save[^{}]*)\{/);
+  assert.ok(saveSelector, 'the save rule\'s selector list is readable');
+  for (const member of ['.craft-save', '.pair-approve']) {
+    assert.ok(saveSelector[1].split(',').map((s) => s.trim()).includes(member), `${member} is the accent door on its page`);
+  }
+});
+
+// ---- 5. the token is quoted, the project is a row, the profile is a band ----
+
+test('the CLI token is quoted — one tonal step down, wrapping anywhere', () => {
+  const fn = settingsJs.match(/async function issueCliToken\([\s\S]*?\n  \}\n/);
+  assert.ok(fn, 'issueCliToken is a whole function');
+  assert.match(fn[0], /class="quote"/, 'the result renders the quote');
+  assert.match(fn[0], /<pre class="quote__pre">\$\{escapeHtml\(body\.paste_command \|\| ''\)\}<\/pre>/, 'the secret is escaped into the pre');
+  assert.doesNotMatch(fn[0], /style="/, 'no inline style on the foot');
+  const pre = ruleOf(settingsCss, '.quote__pre');
+  assert.match(pre, /overflow-wrap:\s*anywhere/, 'a 64-character token wraps inside its quote instead of widening the panel');
+  assert.match(ruleOf(settingsCss, '.quote') || '', /background:\s*var\(--glass\)/, 'one tonal step down from the panel');
+});
+
+// The hall's my-projects page is GONE (owner decision, task 1003308): "my
+// projects" is a user-level page that already lives on the hub, so the hall
+// carries neither the page nor a link nor a redirect to it.
+test('the hall no longer ships a my-projects page', () => {
+  for (const f of ['my-projects.html', 'my-projects.js', 'my-projects.css', 'my-projects.states.json']) {
+    assert.ok(!fs.existsSync(path.join(HALL, f)), `${f} is gone — the page is the hub's`);
+  }
+  for (const f of ['shell.js', 'palette.js']) {
+    assert.doesNotMatch(read(f), /my-projects/, `${f} does not link the page`);
+  }
+});
+
+test('the profile identity band is a MODIFIER on the shell\'s .profile, never a second base rule', () => {
+  assert.match(read('profile.html'), /<div class="profile profile--ident" id="profile-head">/, 'the band opts in from its markup');
+  const css = read('profile.css');
+  assert.ok(ruleOf(css, '.profile--ident'), 'profile.css styles the modifier');
+  assert.equal(ruleOf(css, '.profile'), null, 'and never redeclares bare .profile — Home\'s Standing card shares it');
+  assert.match(ruleOf(css, '.profile--ident .profile__avatar') || '', /var\(--skeleton\)/, 'the avatar placeholder is the skeleton tone, not --bg-deep (pure black in dark)');
+  assert.match(ruleOf(css, '.ach') || '', /background:\s*var\(--bg-card\)/, 'a shelf tile on the bare section is the panel, not a card in a card');
+});
+
+// ---- 6. the floors are reproducible ------------------------------------------
+
+test('all five pages have a states file, so the floors are reproducible', () => {
+  for (const p of PAGES) {
+    const json = JSON.parse(read(`${p}.states.json`));
+    assert.equal(json.surface, 'hall-ui', `${p}.states.json names its surface`);
+    assert.ok(Object.keys(json.states).length >= 2, `${p}.states.json renders more than the default state`);
+  }
+  assert.ok(Object.keys(JSON.parse(read('settings.states.json')).states).length >= 4, 'settings renders every rail group');
+  for (const fx of ['me__sessions', 'auth__app-pair__info']) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', `${fx}.json`)),
+      `the harness serves ${fx} — without it the page only ever rendered its empty state`);
+  }
+});

package/tests/join_application_note.mjs

@@ -94,19 +94,11 @@ test('the relay sends the composed note and the applicant’s name — not a con
   assert.match(join, /note: \{ type: 'string', maxLength: APPLICANT_NOTE_MAX \}/, 'the note is declared in the route’s schema');
 });
 
-test('the join box offers the note as optional, and never demands it', () => {
-  const html = src('modules/hall-ui/public/my-projects.html');
-  assert.match(html, /<textarea id="join-note"/, 'the note field exists');
-  assert.match(html, /maxlength="400"/, 'the field cannot outrun the route’s cap');
-  assert.match(html, /Add a note \(optional\)/, 'and it is labelled optional');
-  assert.match(html, /id="join-status"/, 'the answer line is its own element, not the note field');
-});
-
-test('a door refusal keeps what the applicant typed; a filed request clears it', () => {
-  const js = src('modules/hall-ui/public/my-projects.js');
-  const click = (js.match(/joinBtn\.addEventListener\('click'[\s\S]*?\n  \}\);\n/) || [''])[0];
-  assert.ok(click, 'the join handler must exist');
-  assert.match(click, /note \? \{ origin: origin, note: note \} : \{ origin: origin \}/, 'a blank note is omitted, not sent as ""');
-  assert.match(click, /if \(!refused\) \{ joinInput\.value = ''; joinNoteInput\.value = ''; load\(\); \}/,
-    'cleared only when the request was actually filed — a refusal keeps the words for the next try');
+// The hall's my-projects page (the join box + its click handler) was REMOVED in
+// task 1003308 — "my projects" is a user-level page that lives on the hub, and
+// the hall keeps no copy. The route contract above is the whole surface now;
+// the hub's own join form is pinned by tests/public_landing_projects.mjs.
+test('the hall no longer carries a join box of its own', () => {
+  assert.ok(!fs.existsSync(path.join(ROOT, 'modules/hall-ui/public/my-projects.html')), 'the hall page is gone');
+  assert.ok(!fs.existsSync(path.join(ROOT, 'modules/hall-ui/public/my-projects.js')), 'and its script with it');
 });

package/tests/module-scope-map.mjs

@@ -126,7 +126,7 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
     'modules/platform-identity/platform-identity.js',   // visibility column + catalog domain
     'modules/platform-identity/routes/projects.js',     // the feed + invite routes
     'modules/status-ui/public/explore.js',              // orb render-type surface
-    'modules/hall-ui/public/my-projects.js',            // owner settings / applications queue
+    'modules/hall-ui/public/settings.js',               // the builder's own settings (my-projects.js left the hall in task 1003308)
     'modules/public-landing/public/projects.html',                     // the creation step, ?view=new since task 1002763
     'modules/provisioning/',                            // module-bundle selection at provision time
   ]) {

package/tests/module_api.mjs

@@ -34,6 +34,7 @@ const PUBLISHED_SURFACE = [
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
   'resolveStaleClaimHours', 'staleClaimMinutes', // added by task 1003476 (ADR 0226; goal 1000072): the PROJECT's stale-claim timer — the sweep that releases a silent claim and the Archon roster that reports one read the same number through here, after eighteen hours of disagreeing (6 vs 24)
+  'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',