@bongos/core 1.19.503 → 1.19.505

package/tests/task_detail_ui.mjs

@@ -0,0 +1,710 @@
+// tests/task_detail_ui.mjs — the hall's idea overlay, EXECUTED (task 1003516).
+//
+// modules/hall-ui/public/task-detail.js carries the whole in-hall idea-triage
+// surface: the Promote / Merge / Discard disclosure forms (task 1002447), the
+// version picker, and the goal picker with its hint-beats-suggester precedence
+// and out-of-order-fetch race guard (task 1003071). Until this file its only
+// test asserted on the SOURCE TEXT, so a ReferenceError inside a submit handler
+// passed the suite and 500'd at click time — the class of gap behind the task
+// 1003102 blocker. Browser code fails when a human clicks, and only a harness
+// that clicks can see that.
+//
+// Why a vm harness rather than jsdom: there is no jsdom in this repo. The
+// precedent is tests/goal_criterion_confirm_ui.mjs (after tests/hall_signout.mjs),
+// which runs the real page script inside `vm` under a hand-built DOM stub. This
+// stub goes one step further than those: it PARSES the markup the file writes
+// into innerHTML, so `querySelector('[data-goal-select]')` resolves only if the
+// element is genuinely there, form fields carry the real values the file
+// rendered (escaping included), and every handler runs for real.
+//
+// Covers:
+//   • the overlay boots from the hash and renders the Metic triage panel
+//   • promote with a goal chosen — POST /tasks carries goal_id, the idea is then
+//     PATCHed promoted, and the panel links the created task
+//   • promote opting out — NO goal_id key at all (the server's catch-all bucket
+//     applies only when the key is absent)
+//   • the version change re-fetches that version's goals and repaints the picker;
+//     a raced pair of changes lets only the newest write
+//   • the two-write failure path — the task is created, the idea PATCH fails, and
+//     the created task id survives in the message the builder reads
+//   • merge and discard submit their PATCH, announce, and close the overlay
+//   • a 403 is read out of the NESTED error envelope rather than swallowed
+//
+// Run:  node tests/task_detail_ui.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-detail.js'), 'utf8');
+
+const { test, summary } = makeRunner();
+
+// ===========================================================================
+// A minimal DOM that actually parses what the file writes.
+// ===========================================================================
+
+const VOID_TAGS = new Set(['input', 'br', 'img', 'hr', 'meta', 'link']);
+
+function decodeEntities(s) {
+  return String(s)
+    .replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
+}
+
+function parseAttrs(text) {
+  const out = {};
+  const re = /([\w:-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+  let m;
+  while ((m = re.exec(text))) {
+    const raw = m[2] !== undefined ? m[2] : m[3] !== undefined ? m[3] : m[4] !== undefined ? m[4] : '';
+    out[m[1].toLowerCase()] = decodeEntities(raw);
+  }
+  return out;
+}
+
+// Compound selectors only (tag / .class / #id / [attr] / [attr="v"], comma lists)
+// — that is every selector task-detail.js uses, and refusing anything richer
+// keeps the stub honest about what it can prove.
+function matchesOne(el, sel) {
+  let ok = true;
+  const re = /([a-zA-Z][\w-]*)|\.([\w-]+)|#([\w-]+)|\[([\w:-]+)(?:=["']([^"']*)["'])?\]/g;
+  let m;
+  while ((m = re.exec(sel))) {
+    if (m[1]) ok = ok && el.tagName === m[1].toLowerCase();
+    else if (m[2]) ok = ok && String(el.className || '').split(/\s+/).includes(m[2]);
+    else if (m[3]) ok = ok && el.id === m[3];
+    else if (m[4]) {
+      const have = el.attrs[m[4].toLowerCase()];
+      ok = ok && (m[5] === undefined ? have !== undefined : have === m[5]);
+    }
+  }
+  return ok;
+}
+const matches = (el, sel) => String(sel).split(',').map((s) => s.trim()).filter(Boolean).some((s) => matchesOne(el, s));
+
+function walk(el, fn) {
+  for (const child of el.children) {
+    const hit = fn(child);
+    if (hit) return hit;
+    const deeper = walk(child, fn);
+    if (deeper) return deeper;
+  }
+  return null;
+}
+
+function makeEl(tagName, attrs = {}) {
+  const el = {
+    tagName: String(tagName).toLowerCase(),
+    attrs,
+    children: [],
+    parentNode: null,
+    className: attrs.class || '',
+    id: attrs.id || '',
+    name: attrs.name,
+    dataset: {},
+    disabled: 'disabled' in attrs,
+    style: {},
+    listeners: {},
+    _text: '',
+    _html: null,
+    _value: null,
+
+    get value() {
+      if (this._value !== null) return this._value;
+      if (this.tagName === 'select') {
+        const opts = this.querySelectorAll('option');
+        const chosen = opts.find((o) => 'selected' in o.attrs) || opts[0];
+        return chosen ? (chosen.attrs.value !== undefined ? chosen.attrs.value : chosen.textContent) : '';
+      }
+      return this.attrs.value !== undefined ? this.attrs.value : '';
+    },
+    set value(v) { this._value = String(v); },
+
+    get textContent() { return this._text + this.children.map((c) => c.textContent).join(''); },
+    set textContent(v) { this._text = String(v == null ? '' : v); this.children = []; this._html = null; },
+
+    get innerHTML() { return this._html === null ? '' : this._html; },
+    set innerHTML(v) { this._html = String(v); this._value = null; parseInto(this, this._html); },
+
+    setAttribute(k, v) { this.attrs[String(k).toLowerCase()] = String(v); },
+    getAttribute(k) { const v = this.attrs[String(k).toLowerCase()]; return v === undefined ? null : v; },
+    removeAttribute(k) { delete this.attrs[String(k).toLowerCase()]; },
+    appendChild(child) { child.parentNode = this; this.children.push(child); return child; },
+    remove() {
+      const p = this.parentNode;
+      if (!p) return;
+      p.children = p.children.filter((c) => c !== this);
+      this.parentNode = null;
+    },
+    querySelector(sel) { return walk(this, (c) => (matches(c, sel) ? c : null)); },
+    querySelectorAll(sel) {
+      const out = [];
+      walk(this, (c) => { if (matches(c, sel)) out.push(c); return null; });
+      return out;
+    },
+    closest(sel) {
+      let node = this;
+      while (node) { if (matches(node, sel)) return node; node = node.parentNode; }
+      return null;
+    },
+    addEventListener(type, fn) { (this.listeners[type] = this.listeners[type] || []).push(fn); },
+    focus() {},
+    fire(type, event) { (this.listeners[type] || []).forEach((fn) => fn(event)); },
+  };
+  for (const [k, v] of Object.entries(attrs)) {
+    if (!k.startsWith('data-')) continue;
+    el.dataset[k.slice(5).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = v;
+  }
+  return el;
+}
+
+// The reserved names a <form>'s named-field shorthand (form.title.value) must
+// never shadow — everything else on the element is fair game, same as the DOM.
+const FORM_FIELD_RESERVED = new Set(['tagName', 'attrs', 'children', 'parentNode', 'className', 'id', 'dataset',
+  'disabled', 'style', 'listeners', 'value', 'textContent', 'innerHTML', 'name']);
+
+function parseInto(host, html) {
+  host.children = [];
+  host._text = '';
+  const stack = [host];
+  const re = /<(\/?)([a-zA-Z][\w-]*)([^>]*?)(\/?)>/g;
+  let last = 0;
+  let m;
+  const addText = (raw) => { if (raw) stack[stack.length - 1]._text += decodeEntities(raw); };
+  while ((m = re.exec(html))) {
+    addText(html.slice(last, m.index));
+    last = re.lastIndex;
+    const tag = m[2].toLowerCase();
+    if (m[1]) {
+      for (let i = stack.length - 1; i > 0; i--) if (stack[i].tagName === tag) { stack.length = i; break; }
+      continue;
+    }
+    const el = makeEl(tag, parseAttrs(m[3]));
+    stack[stack.length - 1].appendChild(el);
+    if (!m[4] && !VOID_TAGS.has(tag)) stack.push(el);
+  }
+  addText(html.slice(last));
+  // Named-field access on every form the markup just produced.
+  walk(host, (el) => {
+    if (el.tagName !== 'form') return null;
+    for (const field of el.querySelectorAll('input, select, textarea')) {
+      if (!field.name || FORM_FIELD_RESERVED.has(field.name) || field.name in el) continue;
+      el[field.name] = field;
+    }
+    return null;
+  });
+}
+
+// ===========================================================================
+// The harness: run the real file against a scripted API and hand back handles.
+// ===========================================================================
+
+const IDEA_ID = 1000817;
+const DEFAULT_IDEA = {
+  id: IDEA_ID,
+  status: 'open',
+  title: 'Cover the overlay\'s "promote" & <merge> handlers',
+  body_md: 'The overlay has no executing test.',
+  kind: 'blocker-resolution',
+  suggested_version: 'BV2',
+  suggested_priority: 2,
+  suggested_goal_id: 1000071,
+};
+const DEFAULT_VERSIONS = [
+  { id: 'BV1', name: 'Platform one', status: 'planning' },
+  { id: 'BV2', name: 'Platform two', status: 'active' },
+  { id: 'OLD', name: 'Already out', status: 'shipped' },
+];
+const DEFAULT_SUGGESTIONS = {
+  BV1: [{ id: 1000058, title: 'Consumer path', score: 4, matched_terms: ['overlay'] }],
+  BV2: [{ id: 1000062, title: 'Idea surfaces', score: 6, matched_terms: ['promote', 'merge'] }],
+};
+
+const escapeHtml = (s) => String(s == null ? '' : s).replace(/[&<>"']/g,
+  (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+async function settle(extraMs = 0) {
+  if (extraMs) await tick(extraMs);
+  for (let i = 0; i < 30; i++) await tick(0);
+}
+
+function fail(status, code, message) {
+  return { status, ok: false, data: { error: { code, message } } };
+}
+
+async function boot(opts = {}) {
+  const {
+    idea = DEFAULT_IDEA,
+    rank = 'metic',
+    versions = DEFAULT_VERSIONS,
+    suggestions = DEFAULT_SUGGESTIONS,
+    suggestDelayMs = {},
+    suggestThrows = false,
+    createdTask = { id: 1003600, title: 'Cover the overlay handlers' },
+    createFails = null,
+    patchFails = null,
+    mergeTargets = { 1000900: { id: 1000900, title: 'The canonical idea' } },
+  } = opts;
+
+  const requests = [];
+  const toasts = [];
+  const events = [];
+  const navigations = [];
+
+  const ok = (data) => ({ status: 200, ok: true, data });
+  const api = {
+    async request(method, p, init) {
+      const body = init && init.body;
+      requests.push({ method, path: p, body });
+      const url = p.replace('/api/bongos', '');
+      const [route, query] = url.split('?');
+      if (method === 'GET' && route === '/me') return ok({ builder: { id: 1, rank } });
+      if (method === 'GET' && route === '/versions') return ok({ versions });
+      if (method === 'GET' && route === '/goals/suggestions') {
+        const version = new URLSearchParams(query || '').get('version');
+        const delay = suggestDelayMs[version] || 0;
+        if (delay) await tick(delay);
+        if (suggestThrows) return { status: 503, ok: false, data: null };
+        return ok({ suggestions: suggestions[version] || [] });
+      }
+      if (method === 'GET' && route.startsWith('/inbox/')) {
+        const id = Number(route.slice('/inbox/'.length));
+        if (id === Number(idea.id)) return ok({ idea });
+        if (mergeTargets[id]) return ok({ idea: mergeTargets[id] });
+        return { status: 404, ok: false, data: null };
+      }
+      if (method === 'POST' && route === '/tasks') return createFails || ok({ task: { ...createdTask, title: body.title } });
+      if (method === 'PATCH' && route.startsWith('/inbox/')) return patchFails || ok({ idea: { ...idea, status: body.status } });
+      return ok({});
+    },
+  };
+
+  const locationObj = {
+    hostname: 'builders.example.test',
+    pathname: '/builders',
+    search: '',
+    hash: `#/idea/${idea.id}`,
+    href: '',
+    assign(u) { navigations.push(['assign', u]); },
+    replace(u) { navigations.push(['replace', u]); },
+  };
+  const documentObj = {
+    readyState: 'complete',
+    body: makeEl('body'),
+    documentElement: makeEl('html'),
+    createElement: (tag) => makeEl(tag),
+    getElementById(id) { return walk(this.body, (el) => (el.id === id ? el : null)); },
+    querySelector(sel) { return this.body.querySelector(sel); },
+    querySelectorAll(sel) { return this.body.querySelectorAll(sel); },
+    createTextNode(text) { const n = makeEl('#text'); n._text = String(text); return n; },
+    addEventListener() {},
+  };
+  const windowObj = {
+    OTB: { escapeHtml, toast: (m) => toasts.push(m) },
+    BongosClient: { createClient: () => api },
+    location: locationObj,
+    addEventListener() {},
+    dispatchEvent(ev) { events.push(ev); return true; },
+  };
+  class CustomEvent {
+    constructor(type, init) { this.type = type; this.detail = init && init.detail; }
+  }
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: locationObj, CustomEvent,
+    history: { replaceState() {} },
+    sessionStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    console, setTimeout, clearTimeout, Promise, Date, Math, JSON, Error,
+    Number, String, Object, Array, Boolean, Set, Map, RegExp, encodeURIComponent,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'task-detail.js' });
+  await settle();
+
+  const overlay = () => documentObj.getElementById('deeplink-card');
+  const panel = () => { const o = overlay(); return o ? o.querySelector('.td-triage') : null; };
+  const errText = () => { const p = panel(); const e = p && p.querySelector('[data-err]'); return e ? e.textContent : null; };
+  const requestsTo = (method, re) => requests.filter((r) => r.method === method && re.test(r.path));
+
+  // A real delegated click: the panel's own listener, handed a target whose
+  // closest() walks the parsed tree — exactly what the browser passes it.
+  async function clickGo(mode) {
+    const p = panel();
+    assert.ok(p, 'the triage panel must be rendered before a click');
+    const btn = p.querySelector(`[data-go="${mode}"]`);
+    assert.ok(btn, `no [data-go="${mode}"] control in the panel — got: ${p.innerHTML}`);
+    p.fire('click', { target: btn });
+    await settle();
+    return btn;
+  }
+
+  async function submitForm(which) {
+    const form = panel().querySelector(`[data-form="${which}"]`);
+    assert.ok(form, `no ${which} form rendered`);
+    let prevented = false;
+    form.fire('submit', { preventDefault() { prevented = true; }, target: form });
+    await settle();
+    // The handler is wired with preventDefault() first: if this is false the
+    // submit listener never ran and every assertion below would be vacuous.
+    assert.equal(prevented, true, `the ${which} submit handler did not execute`);
+    return form;
+  }
+
+  async function changeVersion(versionId, { wait = 0 } = {}) {
+    const sel = panel().querySelector('select[name="version"]');
+    assert.ok(sel, 'the promote form must offer a version picker');
+    sel.value = versionId;
+    sel.fire('change', {});
+    if (wait) await settle(wait);
+    return sel;
+  }
+
+  return {
+    requests, requestsTo, toasts, events, navigations,
+    overlay, panel, errText, clickGo, submitForm, changeVersion, settle,
+    goalSelect: () => panel().querySelector('[data-goal-select]'),
+    field: (which, name) => panel().querySelector(`[data-form="${which}"]`)[name],
+  };
+}
+
+// ===========================================================================
+// The overlay boots and offers the triage panel
+// ===========================================================================
+
+await test('the overlay boots off the hash and renders the panel for a Metic', async () => {
+  const h = await boot();
+  assert.ok(h.overlay(), 'a #deeplink-card overlay is mounted');
+  assert.ok(h.panel(), 'and an open idea carries the triage panel');
+  const verbs = h.panel().querySelectorAll('[data-go]').map((b) => b.dataset.go);
+  assert.deepEqual(verbs, ['promote', 'merge', 'discard'], 'all three verdicts are reachable');
+});
+
+await test('a Xenos gets the card but no triage panel (the server gate is mirrored, not trusted)', async () => {
+  const h = await boot({ rank: 'xenos' });
+  assert.ok(h.overlay(), 'the record is still readable');
+  assert.equal(h.panel(), null, 'the actions are not offered below Metic');
+});
+
+await test('a closed idea offers no triage panel', async () => {
+  const h = await boot({ idea: { ...DEFAULT_IDEA, status: 'promoted' } });
+  assert.equal(h.panel(), null, 'a settled idea has nothing left to decide');
+});
+
+// ===========================================================================
+// Promote — the form the version and goal pickers live on
+// ===========================================================================
+
+await test('opening Promote loads open versions only, and preselects the idea\'s suggested one', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  const vsel = h.panel().querySelector('select[name="version"]');
+  const ids = vsel.querySelectorAll('option').map((o) => o.attrs.value);
+  assert.deepEqual(ids, ['BV1', 'BV2'], 'a shipped version would 409 the create, so it is not offered');
+  assert.equal(vsel.value, 'BV2', 'the idea\'s suggested_version is honoured');
+});
+
+await test('the goal picker leads with the STORED hint, then the suggester, then the opt-out', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  const opts = h.goalSelect().querySelectorAll('option');
+  assert.equal(opts[0].attrs.value, '1000071', 'the hint carried from the filing comes first');
+  assert.ok('selected' in opts[0].attrs, 'and it is what the form will submit');
+  assert.match(opts[0].textContent, /carried from the filing/);
+  assert.equal(opts[1].attrs.value, '1000062', 'the suggester fills in below it');
+  assert.match(opts[1].textContent, /matched: promote, merge/, 'with the evidence for judging it');
+  assert.equal(opts[opts.length - 1].attrs.value, '', 'the opt-out is always available');
+});
+
+await test('with no stored hint the top suggestion is preselected instead', async () => {
+  const h = await boot({ idea: { ...DEFAULT_IDEA, suggested_goal_id: null } });
+  await h.clickGo('promote');
+  assert.equal(h.goalSelect().value, '1000062', 'the suggester supplies the default when nothing was named');
+});
+
+await test('a suggester outage degrades to the opt-out rather than blocking the verdict', async () => {
+  const h = await boot({ suggestThrows: true, idea: { ...DEFAULT_IDEA, suggested_goal_id: null } });
+  await h.clickGo('promote');
+  const opts = h.goalSelect().querySelectorAll('option');
+  assert.equal(opts.length, 1, 'only the opt-out remains');
+  assert.equal(h.goalSelect().value, '', 'and it is selected, so the form is still submittable');
+});
+
+await test('promote with a goal chosen POSTs goal_id, then marks the idea promoted', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+
+  const posts = h.requestsTo('POST', /\/tasks$/);
+  assert.equal(posts.length, 1, `exactly one create — got ${JSON.stringify(h.requests.map((r) => r.method + ' ' + r.path))}`);
+  const body = posts[0].body;
+  assert.equal(body.goal_id, 1000071, 'the chosen goal reaches the server as a number');
+  assert.equal(body.version_id, 'BV2');
+  assert.equal(body.priority, 2, 'suggested_priority is carried, clamped into the 1-5 the column allows');
+  assert.equal(body.source_ref, `idea:${IDEA_ID}`, 'provenance makes a retried promote idempotent');
+  assert.equal(body.kind, 'blocker-resolution', 'the idea\'s kind saves the classifier a guess');
+  assert.match(body.description, /Promoted from idea/, 'the task says where it came from');
+  assert.ok(!('est_minutes' in body) && !('credits_reward' in body), 'blank number fields are omitted, not sent as 0');
+
+  const patches = h.requestsTo('PATCH', new RegExp(`/inbox/${IDEA_ID}$`));
+  assert.equal(patches.length, 1, 'the idea is linked to the task it became');
+  assert.equal(patches[0].body.status, 'promoted');
+  assert.equal(patches[0].body.promoted_to_task_id, 1003600);
+
+  assert.match(h.panel().innerHTML, /Promoted to task/, 'the panel reports the result');
+  assert.match(h.panel().innerHTML, /href="\/task\/1003600"/, 'and links the task it made');
+  assert.ok(h.events.some((e) => e.type === 'otb:idea-triaged' && e.detail.verdict === 'promoted'),
+    'home\'s attention inbox is told so the queue advances behind the overlay');
+});
+
+await test('the title survives escaping — what the form renders is what gets created', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+  assert.equal(h.requestsTo('POST', /\/tasks$/)[0].body.title, DEFAULT_IDEA.title,
+    'quotes and angle brackets must round-trip through the value attribute unmangled');
+});
+
+await test('promote opting OUT of a goal sends no goal_id key at all', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  h.goalSelect().value = '';
+  await h.submitForm('promote');
+  const body = h.requestsTo('POST', /\/tasks$/)[0].body;
+  assert.ok(!('goal_id' in body),
+    'the version\'s general bucket applies only on an ABSENT key — sending null or "" would be a different create');
+});
+
+await test('an empty title is refused in the browser, before a doomed request', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  h.panel().querySelector('[name="title"]').value = '   ';
+  await h.submitForm('promote');
+  assert.equal(h.requestsTo('POST', /\/tasks$/).length, 0, 'nothing is sent');
+  assert.match(h.errText(), /A task needs a title/);
+});
+
+// ===========================================================================
+// The version change re-fetches goals (task 1003071's race guard)
+// ===========================================================================
+
+await test('changing the version re-fetches THAT version\'s goals and repaints the picker', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  const before = h.requestsTo('GET', /\/goals\/suggestions/).length;
+  await h.changeVersion('BV1', { wait: 5 });
+
+  const fetches = h.requestsTo('GET', /\/goals\/suggestions/);
+  assert.equal(fetches.length, before + 1, 'exactly one re-fetch');
+  assert.match(fetches[fetches.length - 1].path, /version=BV1/, 'for the version now selected');
+
+  const opts = h.goalSelect().querySelectorAll('option').map((o) => o.attrs.value);
+  assert.ok(opts.includes('1000058'), `BV1's goals are painted — got ${JSON.stringify(opts)}`);
+  assert.ok(!opts.includes('1000062'), 'and BV2\'s are gone — offering them would be a home the server rejects');
+  assert.equal(h.goalSelect().disabled, false, 'the control is handed back to the builder');
+});
+
+await test('two quick version changes: only the NEWEST is allowed to write', async () => {
+  // The slow reply belongs to the abandoned selection; if it were allowed to
+  // land it would paint the wrong version's goals over the right ones.
+  const h = await boot({ suggestDelayMs: { BV1: 40 } });
+  await h.clickGo('promote');
+  await h.changeVersion('BV1');
+  await h.changeVersion('BV2');
+  await h.settle(80);
+
+  const opts = h.goalSelect().querySelectorAll('option').map((o) => o.attrs.value);
+  assert.ok(opts.includes('1000062'), `the newest request's goals stand — got ${JSON.stringify(opts)}`);
+  assert.ok(!opts.includes('1000058'), 'the stale reply is dropped, not painted');
+  assert.equal(h.goalSelect().disabled, false, 'and the newest request re-enabled the control');
+});
+
+await test('after a version change the promoted task is created against the NEW version', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.changeVersion('BV1', { wait: 5 });
+  await h.submitForm('promote');
+  const body = h.requestsTo('POST', /\/tasks$/)[0].body;
+  assert.equal(body.version_id, 'BV1');
+  assert.equal(body.goal_id, 1000058, 'and against a goal that belongs to it');
+});
+
+await test('the filed goal hint does NOT survive a version change — it would 400', async () => {
+  // The defect this harness was built to find. A goal belongs to exactly one
+  // version and POST /tasks rejects a foreign one with bad_goal_id, so carrying
+  // the filing's hint onto another version offered the one option guaranteed to
+  // fail — pre-selected, as the default the builder would submit.
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.changeVersion('BV1', { wait: 5 });
+  const opts = h.goalSelect().querySelectorAll('option').map((o) => o.attrs.value);
+  assert.ok(!opts.includes('1000071'), `the other version's hint is not offered — got ${JSON.stringify(opts)}`);
+});
+
+await test('changing BACK to the filed version restores the hint as the default', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.changeVersion('BV1', { wait: 5 });
+  await h.changeVersion('BV2', { wait: 5 });
+  assert.equal(h.goalSelect().value, '1000071', 'the filing\'s guess is honoured wherever it is valid');
+});
+
+// ===========================================================================
+// The two-write failure path
+// ===========================================================================
+
+await test('create succeeds but the idea PATCH fails: the task id is NOT lost', async () => {
+  const h = await boot({ patchFails: fail(500, 'internal_error', 'boom') });
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+
+  assert.equal(h.requestsTo('POST', /\/tasks$/).length, 1, 'the task was created');
+  const msg = h.errText();
+  assert.match(msg, /1003600/, 'the created task id is in front of the builder — "could not create" would send them to make a twin');
+  assert.match(msg, /Press Create task again/, 'and the retry is named as the fix');
+  assert.match(msg, /it does not make a second one/, 'because the create is idempotent on source_ref');
+  assert.match(h.panel().innerHTML, /data-form="promote"/, 'the form is still standing to retry from');
+  assert.equal(h.panel().querySelector('[data-submit]').disabled, false, 'and the button is usable again');
+  assert.equal(h.panel().querySelector('[data-submit]').textContent, 'Create task', 'restored from its busy label');
+  assert.ok(!h.events.some((e) => e.type === 'otb:idea-triaged'),
+    'nothing is announced — the idea is still open');
+});
+
+await test('retrying after that failure re-sends the SAME create rather than a second one', async () => {
+  const h = await boot({ patchFails: fail(500, 'internal_error', 'boom') });
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+  await h.submitForm('promote');
+  const posts = h.requestsTo('POST', /\/tasks$/);
+  assert.equal(posts.length, 2, 'the retry goes back through the create');
+  assert.equal(posts[0].body.source_ref, posts[1].body.source_ref,
+    'with the same idempotency key, so the server resolves it to one task');
+});
+
+await test('a failed create reports the server\'s reason and leaves the idea alone', async () => {
+  const h = await boot({ createFails: fail(409, 'version_closed', 'nope') });
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+  assert.equal(h.requestsTo('PATCH', /\/inbox\//).length, 0, 'no idea is marked promoted against a task that does not exist');
+  assert.match(h.errText(), /That version has shipped/, 'the code is mapped to something a human can act on');
+});
+
+await test('a 403 is read out of the NESTED error envelope, not swallowed', async () => {
+  // err.data.error is an OBJECT: reading it as a string would make every code
+  // comparison silently miss and fall through to the generic message.
+  const h = await boot({ createFails: fail(403, 'permission_forbidden', 'no') });
+  await h.clickGo('promote');
+  await h.submitForm('promote');
+  assert.match(h.errText(), /Only Metic\+ can triage ideas/);
+});
+
+// ===========================================================================
+// Merge and Discard
+// ===========================================================================
+
+await test('merge PATCHes the fold, announces it, and closes the overlay', async () => {
+  const h = await boot();
+  await h.clickGo('merge');
+  h.field('merge', 'target').value = '1000900';
+  h.field('merge', 'note').value = 'same request, twice';
+  await h.submitForm('merge');
+
+  const patch = h.requestsTo('PATCH', new RegExp(`/inbox/${IDEA_ID}$`))[0];
+  assert.equal(patch.body.status, 'merged');
+  assert.equal(patch.body.merged_into_idea_id, 1000900);
+  assert.equal(patch.body.triage_note, 'same request, twice');
+  assert.ok(h.events.some((e) => e.detail.verdict === 'merged'), 'the queue behind the overlay is told');
+  assert.ok(h.toasts.some((t) => /merged into/.test(t)), `the verdict is confirmed — got ${JSON.stringify(h.toasts)}`);
+  assert.equal(h.overlay(), null, 'a verdict that leaves nothing to look at closes the card');
+});
+
+await test('the merge form echoes the target idea\'s title so a typo is visible', async () => {
+  const h = await boot();
+  await h.clickGo('merge');
+  const input = h.field('merge', 'target');
+  input.value = '1000900';
+  input.fire('change', {});
+  await h.settle();
+  assert.match(h.panel().querySelector('[data-target-name]').textContent, /The canonical idea/);
+
+  input.value = '999999';
+  input.fire('change', {});
+  await h.settle();
+  assert.match(h.panel().querySelector('[data-target-name]').textContent, /no idea/, 'an unknown number says so');
+});
+
+await test('merge refuses a blank target in the browser', async () => {
+  const h = await boot();
+  await h.clickGo('merge');
+  await h.submitForm('merge');
+  assert.equal(h.requestsTo('PATCH', /\/inbox\//).length, 0);
+  assert.match(h.errText(), /Give the idea number/);
+});
+
+await test('discard PATCHes the reason and closes the overlay', async () => {
+  const h = await boot();
+  await h.clickGo('discard');
+  h.field('discard', 'note').value = 'already covered elsewhere';
+  await h.submitForm('discard');
+  const patch = h.requestsTo('PATCH', new RegExp(`/inbox/${IDEA_ID}$`))[0];
+  assert.equal(patch.body.status, 'discarded');
+  assert.equal(patch.body.triage_note, 'already covered elsewhere');
+  assert.ok(h.events.some((e) => e.detail.verdict === 'discarded'));
+  assert.equal(h.overlay(), null);
+});
+
+await test('a discard with no reason sends null, not an empty string', async () => {
+  const h = await boot();
+  await h.clickGo('discard');
+  await h.submitForm('discard');
+  assert.equal(h.requestsTo('PATCH', /\/inbox\//)[0].body.triage_note, null);
+});
+
+await test('a failed discard keeps the form up with the reason typed into it', async () => {
+  // No envelope at all (a proxy 500, a dropped body): the fallback sentence has
+  // to stand in, because an empty message would leave the panel silent.
+  const h = await boot({ patchFails: { status: 500, ok: false, data: null } });
+  await h.clickGo('discard');
+  h.field('discard', 'note').value = 'no longer wanted';
+  await h.submitForm('discard');
+  assert.ok(h.overlay(), 'the overlay stays open on a failure');
+  assert.match(h.errText(), /Could not discard that idea/);
+  assert.equal(h.field('discard', 'note').value, 'no longer wanted', 'the typed reason is not thrown away');
+});
+
+await test('a server message in the envelope is shown verbatim rather than replaced', async () => {
+  const h = await boot({ patchFails: fail(422, 'unprocessable', 'That idea was already triaged.') });
+  await h.clickGo('discard');
+  await h.submitForm('discard');
+  assert.equal(h.errText(), 'That idea was already triaged.',
+    'an unmapped code still tells the builder what the server said');
+});
+
+// ===========================================================================
+// Getting back out of a form
+// ===========================================================================
+
+await test('Cancel returns to the three verbs without sending anything', async () => {
+  const h = await boot();
+  await h.clickGo('promote');
+  await h.clickGo('idle');
+  const verbs = h.panel().querySelectorAll('[data-go]').map((b) => b.dataset.go);
+  assert.deepEqual(verbs, ['promote', 'merge', 'discard']);
+  assert.equal(h.requestsTo('POST', /\/tasks$/).length, 0);
+});
+
+await test('a version list that will not load offers a way back rather than a dead panel', async () => {
+  const h = await boot({ versions: [] });
+  await h.clickGo('promote');
+  assert.match(h.panel().textContent, /No open version/);
+  assert.ok(h.panel().querySelector('[data-go="idle"]'), 'a builder is never stranded mid-panel');
+});
+
+summary();