@bongos/core 1.19.512 → 1.19.514

package/modules/platform-identity/routes/projects.js

@@ -1,7 +1,14 @@
 // modules/platform-identity/routes/projects.js — the hub projects catalog + the
 // curated public Explore showcase (ADR 0141 §5, task #1002110).
 //
-//   GET   /projects/featured   — PUBLIC Explore listing (featured + active only)
+//   GET   /projects/featured   — PUBLIC projects feed: every project on the map
+//                                (active + publishable), each carrying its `state`
+//                                and `orb` render type, stealth rows anonymised
+//                                server-side, dark matter excluded (ADR 0182 D2a/D3).
+//                                The PATH keeps the old word: it is a rank:public,
+//                                CORS-open URL that a static site and other origins
+//                                already fetch, and renaming it would break them for
+//                                nothing. `featured` now only RANKS the feed.
 //   GET   /projects            — Archon: full curation list (+ featured flags, the stored
 //                                join door, and the DERIVED publish verdict — ADR 0182)
 //   POST  /projects            — Archon: create / update a catalog entry
@@ -141,13 +148,20 @@ module.exports = function projectsRoutes() {
     }
   });
 
-  // The PUBLIC Explore showcase — featured + active projects only, public projection.
-  // CORS-enabled cross-origin read (a status page / the apex fetches it pre-auth).
+  // The PUBLIC projects feed — every project ON THE MAP (active + publishable),
+  // public projection. CORS-enabled cross-origin read (a status page / the apex /
+  // the static orbs site fetches it pre-auth).
   router.use('/projects/featured', corsPublicGet('/projects/featured'));
-  // rank: public — a curated public showcase; no auth by design.
+  // rank: public — the public map of projects; no auth by design.
   router.get('/projects/featured', async (_req, res) => {
     try {
-      const projects = await pi.listFeaturedProjects({ pool });
+      const projects = await pi.listPublicProjects({ pool });
+      // A stealth project is on the map ANONYMOUSLY (ADR 0182 D2a), so its origin
+      // is kept out of both enrichments below: asking its own public API for its
+      // builders and their avatars would put identity on the wire, and tell that
+      // project it was being enumerated. feedShapeFor() redacts the row either
+      // way — this is the half that never makes the request at all.
+      const identified = projects.filter((p) => !pi.isStealthProject(p));
       // Builders + tags come from each project's OWN public API, because the
       // apex catalog does not know them and the membership tables would report
       // zero for every hand-wired project (task 1002771; see project-stats.js).
@@ -156,7 +170,7 @@ module.exports = function projectsRoutes() {
       // listing — a broken stats fetch cannot take the catalog down with it.
       let stats = {};
       try {
-        stats = await projectStats.getProjectStats(projects.map((p) => p.origin));
+        stats = await projectStats.getProjectStats(identified.map((p) => p.origin));
       } catch (err) {
         console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
       }
@@ -168,7 +182,7 @@ module.exports = function projectsRoutes() {
       // a failed read leaves every project on the platform's own pick.
       let planets = {};
       try {
-        planets = await api.resolveOptional('provisioning.projectPlanets', async () => ({}))(projects.map((p) => hostOfOrigin(p.origin)));
+        planets = await api.resolveOptional('provisioning.projectPlanets', async () => ({}))(identified.map((p) => hostOfOrigin(p.origin)));
       } catch (err) {
         log.warn('project planets enrichment failed (non-fatal):', err.message);
       }
@@ -183,8 +197,13 @@ module.exports = function projectsRoutes() {
       // catalog's; a project that did not answer carries the ONE shared null
       // shape, so the wire never drops a key. art_url is catalog text an Archon
       // typed — scheme-checked here, and again on the client, before it is a src.
+      // feedShapeFor() is the LAST thing each row passes through, deliberately: it
+      // derives `state` + `orb` from the stored door and, for a stealth project,
+      // rebuilds the row from an allow-list of the two keys a black hole may carry
+      // (ADR 0182 D2a). Redacting any earlier would be silently undone by the
+      // spreads above.
       res.json({
-        projects: projects.map((p) => ({
+        projects: projects.map((p) => pi.feedShapeFor({
           ...p,
           art_url: projectStats.httpUrl(p.art_url, 2048),
           ...(stats[p.origin] || projectStats.NULL_STATS),

package/modules/platform-identity/tests/platform-identity.mjs

@@ -261,17 +261,21 @@ await ta('upsertProject carries the planet template, COALESCE-preserved; an unkn
   for (const t of P.PROJECT_TEMPLATES.slice(0, 9)) assert.ok(mig12.includes(`'${t}'`), `migration 012 named ${t}`);
   // and the public projection carries it, so the sky can read a curated choice
   const pool3 = mockPool([{ rows: [] }]);
-  await P.listFeaturedProjects({ pool: pool3 });
+  await P.listPublicProjects({ pool: pool3 });
   const sel = (pool3.calls[0].text.match(/SELECT([\s\S]*?)FROM/i) || [, ''])[1];
-  assert.match(sel, /\btemplate\b/, 'the featured projection carries the template');
+  assert.match(sel, /\btemplate\b/, 'the public projection carries the template');
 });
 
-await ta('listFeaturedProjects returns a PUBLIC projection (featured+active only, no owner/status)', async () => {
+await ta('listPublicProjects returns a PUBLIC projection (on-the-map only, no owner/status)', async () => {
   const pool = mockPool([{ rows: [{ origin: 'https://p', name: 'Proj', tagline: 't', art_url: null, created_at: '2026-08-01T00:00:00Z' }] }]);
-  const out = await P.listFeaturedProjects({ pool });
+  const out = await P.listPublicProjects({ pool });
   assert.equal(out.length, 1);
   const c = pool.calls[0];
-  assert.match(c.text, /WHERE featured = true AND status = 'active'/);
+  // R06 (task 1002325) replaced the `featured = true` gate with the derived publish
+  // gate: a project is on the map iff it is active AND publishable (ADR 0182 D3).
+  // The full predicate + the stealth redaction are pinned by tests/visible_projects_feed.mjs.
+  assert.match(c.text, /WHERE status = 'active' AND /);
+  assert.ok(c.text.includes(P.publishableSql()), 'the map predicate is the shared gate');
   // Pin the SELECT LIST itself, not the whole query — an ORDER BY mention must
   // not satisfy a projection guard, and SELECT * must never sneak owner/status
   // onto a CORS-open rank:public route.

package/modules/provisioning/recommendations.js

@@ -0,0 +1,260 @@
+// modules/provisioning/recommendations.js — the RULE ENGINE that turns what an
+// owner said during project creation into a recommended starter bundle, a
+// recommended governance preset, and an invite suggestion (BV1.R17, task
+// 1002336; goal 1000046 criteria `proj-module-select`, `proj-governance-reco`,
+// `proj-invite-builders`).
+//
+// WHY. Goal 1000046 pins the near term as RULE-BASED and defers the semantic
+// layer: "near-term recommendations are rule-based and module search is lexical;
+// the AI/embeddings layer … is a deferred follow-up captured in the idea inbox"
+// (idea 1000552, task 1003500). So this file is a set of small declarative
+// TABLES — condition -> effect -> a one-line `reason` in the owner's own words —
+// and a resolver over them. Not a model, not a scoring function, and nothing
+// that reads the free-text description: a rule an owner cannot be told the
+// reason for is a recommendation they cannot audit.
+//
+// TWO INPUTS, AND ONLY TWO. `type` is the DECLARED project type (a column, the
+// closed set task 1002772 fixed) and `team_shape` is the one closed-answer key
+// the R15 interview collects (`PROJECT_DETAIL_VOCAB` in provisioning.js beside
+// this file). The interview deliberately does not re-ask the type (ADR 0237 §2),
+// so the two arrive separately and this is the file that puts them together.
+//
+// SKIPPING IS A SUPPORTED ANSWER, NOT A GAP. The interview is optional (ADR 0182
+// D4), so every table has a stated DEFAULT for "nobody said" and the defaults are
+// deliberately the narrowest option — the type's own bundle unadjusted, the
+// governance preset that grants nobody anything, and no invites. An off-vocabulary
+// team shape reads as no answer for the same reason `normalizeProjectDetail` drops
+// one: inventing an answer nobody gave feeds the recommendation a lie. R18 (task
+// 1002337) is the live proof of exactly that split.
+//
+// PURE — no I/O, no core import, no sibling-module import; requires only its own
+// module's `starter-bundles.js` and `provisioning.js`, both of which are pure
+// themselves. That is what lets a route, a script and a test read one answer.
+// It is also why `invites.suggested` is always empty here: ranking builders means
+// querying the leaderboard, which lives in a sibling module (`economy`) this one
+// may not import (the one-way rule, ADR 0083). The engine states WHAT to look for
+// in `invites.seeking`; R28 (task 1002347) owns the lookup that fills it.
+//
+// Decision record: ADR 0239.
+
+'use strict';
+
+const { bundleForProjectType, ALWAYS_ON_CORE } = require('./starter-bundles');
+const { PROJECT_DETAIL_VOCAB } = require('./provisioning');
+
+// How the team shape adjusts the type's starter bundle, in application order.
+// Each entry is one condition (`teamShape`) and one effect on ONE opt-in module,
+// carrying the sentence a picker shows when it fires. Deliberately tiny: ADR 0237
+// already made the per-type preset the opinion, and today's opt-in catalog is
+// three modules wide (`agents`, `dev-box`, `discord`) — so this table's job is to
+// correct a preset the owner's answer contradicts, not to re-derive it.
+//
+// A rule may only ever name an OPT-IN module. Adding or removing an always-on one
+// would be a toggle that toggles nothing (ADR 0237 §3's argument, and
+// `tests/provisioning_recommendations.mjs` fails the build over it).
+const TEAM_SHAPE_RULES = Object.freeze([
+  Object.freeze({
+    id: 'a-community-needs-somewhere-to-gather',
+    teamShape: 'community',
+    effect: 'add',
+    module: 'discord',
+    reason: 'You said an open community is building this, so somewhere for it to gather is switched on.',
+  }),
+  Object.freeze({
+    id: 'a-team-shares-one-environment',
+    teamShape: 'small-team',
+    effect: 'add',
+    module: 'dev-box',
+    reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.',
+  }),
+  Object.freeze({
+    id: 'building-alone-needs-no-shared-environment',
+    teamShape: 'solo',
+    effect: 'remove',
+    module: 'dev-box',
+    reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.',
+  }),
+]);
+
+// The governance presets, by key. A preset is a NAME plus the one sentence that
+// says what living under it feels like — never a set of roles or permissions,
+// because there is nowhere to put them: the governance module is planned (goal
+// 1000030) and unbuilt, which criterion `proj-governance-reco` says out loud.
+// R25 (task 1002344) is the spike that fits these to the real module when it
+// exists; until then every recommendation carries `applied: false` so a form can
+// label it a preview without hardcoding that fact in four places.
+const GOVERNANCE_PRESETS = Object.freeze({
+  'owner-only': Object.freeze({
+    label: 'You decide',
+    preview: 'You hold every role. Nothing waits on anyone else, and nothing changes without you.',
+  }),
+  'trusted-team': Object.freeze({
+    label: 'A trusted team',
+    preview: 'Everyone you invite can build and ship. You keep the decisions that spend money or change the shape of the project.',
+  }),
+  'open-contribution': Object.freeze({
+    label: 'Open contribution',
+    preview: 'Anyone can turn up and propose work. A small circle you choose reviews what actually lands.',
+  }),
+});
+
+// Team shape -> governance preset. One row per shape the interview can return;
+// the integrity test fails the build if a shape in `PROJECT_DETAIL_VOCAB` has no
+// row here, so a fourth answer can never be added and silently unhandled.
+const GOVERNANCE_RULES = Object.freeze([
+  Object.freeze({
+    teamShape: 'solo',
+    preset: 'owner-only',
+    reason: 'You said you are building this alone.',
+  }),
+  Object.freeze({
+    teamShape: 'small-team',
+    preset: 'trusted-team',
+    reason: 'You said a small team is building this, so the people you invite can get on with it without asking first.',
+  }),
+  Object.freeze({
+    teamShape: 'community',
+    preset: 'open-contribution',
+    reason: 'You said an open community is building this, so people can arrive and propose work without an invite.',
+  }),
+]);
+
+// What a skipped interview gets. The narrowest preset on purpose: widening later
+// costs one setting, while a project that quietly granted strangers a role it was
+// never asked to grant is not recoverable by changing the setting back.
+const GOVERNANCE_DEFAULT = Object.freeze({
+  preset: 'owner-only',
+  reason: 'Nobody has said who is building this yet, so this is the narrowest setup — widen it whenever you like.',
+});
+
+// Team shape -> who is worth suggesting, as a SEEK — the kind of builder to look
+// for and how many. This engine is pure and cannot run the lookup (the
+// leaderboard lives in the `economy` module, which this one may not import), so
+// `seeking` is the seam R28 (task 1002347) reads and `suggested` stays empty.
+// `seeking: null` means "suggest nobody", which is a real answer and not a
+// missing one.
+const INVITE_RULES = Object.freeze([
+  Object.freeze({
+    teamShape: 'solo',
+    seeking: null,
+    reason: 'You said you are building alone, so nobody is suggested. You can invite anyone later from the project settings.',
+  }),
+  Object.freeze({
+    teamShape: 'small-team',
+    seeking: Object.freeze({ kind: 'top-builders', limit: 3 }),
+    reason: 'A small team is the shape that fills fastest, so here is a short list of the builders with the strongest recent record.',
+  }),
+  Object.freeze({
+    teamShape: 'community',
+    seeking: Object.freeze({ kind: 'top-builders', limit: 5 }),
+    reason: 'An open community wants a wider first circle, so the list runs longer. Guilds join it once guilds can be invited.',
+  }),
+]);
+
+// What a skipped interview gets: nobody. Same reasoning as the governance
+// default — an invite suggested on an answer nobody gave is a stranger the owner
+// never asked for.
+const INVITE_DEFAULT = Object.freeze({
+  seeking: null,
+  reason: 'Nobody has said who is building this yet, so nothing is suggested. Invites can be sent any time from the project settings.',
+});
+
+// The interview's answer, or null. Anything outside `PROJECT_DETAIL_VOCAB` —
+// absent, misspelled, or a value that was valid when it was stored and has since
+// left the vocabulary — reads as NO ANSWER, exactly as `normalizeProjectDetail`
+// drops it on the way in. PURE.
+function normalizeTeamShape(value) {
+  return PROJECT_DETAIL_VOCAB.team_shape.includes(value) ? value : null;
+}
+
+// Apply the team-shape rules to one type's opt-in bundle. Returns the adjusted
+// list plus the adjustments that ACTUALLY changed it — a rule whose module the
+// bundle already carries (or already lacks) records nothing, because a stated
+// reason for a change that did not happen is a lie the owner cannot check.
+// Never touches the always-on core. PURE.
+function adjustBundle(bundle, teamShape) {
+  const modules = [...bundle];
+  const adjustments = [];
+  for (const rule of TEAM_SHAPE_RULES) {
+    if (rule.teamShape !== teamShape) continue;
+    const at = modules.indexOf(rule.module);
+    if (rule.effect === 'add' && at === -1) modules.push(rule.module);
+    else if (rule.effect === 'remove' && at !== -1) modules.splice(at, 1);
+    else continue;
+    adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
+  }
+  return { modules, adjustments };
+}
+
+// The whole recommendation for one set of creation answers:
+//
+//   {
+//     type, teamShape,          // what was actually declared/answered (null = not)
+//     tailored,                 // did a DETAIL answer shape any of this?
+//     bundle:     { type, label, summary, core, bundle, modules, adjustments },
+//     governance: { preset, label, preview, reason, applied },
+//     invites:    { suggested, seeking, reason },
+//   }
+//
+// `bundle` is ADR 0237 §5's shape with one key added, so R20's picker and this
+// engine can never name different modules; `adjustments` is the delta the rules
+// made to it and is empty when nothing fired. `tailored` is false when the
+// interview was skipped — the machine-readable half of criterion
+// `proj-detail-interview`'s "completing it produces tailored recommendations;
+// skipping produces sensible defaults", and what R18 (task 1002337) proves.
+//
+// Accepts a flat object because the two answers live in two places: `type` is a
+// column and `team_shape` is a key of the `detail` jsonb, so a caller holding a
+// row passes `{ type: row.type, ...projectDetail(row) }`. Never throws and never
+// invents an answer. PURE — result arrays and objects are fresh, so a caller may
+// sort or splice them without corrupting the frozen tables.
+function recommendationsForDetails(answers) {
+  const given = answers && typeof answers === 'object' && !Array.isArray(answers) ? answers : {};
+  const teamShape = normalizeTeamShape(given.team_shape);
+  const preset = bundleForProjectType(given.type);
+  const { modules, adjustments } = adjustBundle(preset.bundle, teamShape);
+
+  const gov = GOVERNANCE_RULES.find((r) => r.teamShape === teamShape) || GOVERNANCE_DEFAULT;
+  const invite = INVITE_RULES.find((r) => r.teamShape === teamShape) || INVITE_DEFAULT;
+
+  return {
+    type: preset.type,
+    teamShape,
+    tailored: teamShape !== null,
+    bundle: {
+      type: preset.type,
+      label: preset.label,
+      summary: preset.summary,
+      core: [...ALWAYS_ON_CORE],
+      bundle: modules,
+      modules: [...ALWAYS_ON_CORE, ...modules],
+      adjustments,
+    },
+    governance: {
+      preset: gov.preset,
+      label: GOVERNANCE_PRESETS[gov.preset].label,
+      preview: GOVERNANCE_PRESETS[gov.preset].preview,
+      reason: gov.reason,
+      // Always false until the governance module ships (goal 1000030). A named
+      // recommendation, never an applied setting — criterion `proj-governance-reco`.
+      applied: false,
+    },
+    invites: {
+      // The seam, not an omission: ranking builders is a leaderboard query this
+      // pure file may not run. R28 (task 1002347) fills this from `seeking`.
+      suggested: [],
+      seeking: invite.seeking ? { ...invite.seeking } : null,
+      reason: invite.reason,
+    },
+  };
+}
+
+module.exports = {
+  TEAM_SHAPE_RULES,
+  GOVERNANCE_PRESETS,
+  GOVERNANCE_RULES,
+  GOVERNANCE_DEFAULT,
+  INVITE_RULES,
+  INVITE_DEFAULT,
+  recommendationsForDetails,
+};

package/modules/provisioning/routes/provisioning.js

@@ -23,6 +23,7 @@
 //     GET    /provisioning/health                   — liveness + core version
 //     GET    /provisioning/onboard-plan             — the canonical onboarding step sequence
 //     GET    /provisioning/starter-bundles          — the curated module preset per project type
+//     GET    /provisioning/recommendations          — bundle/governance/invite recommendations from the answers
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
@@ -36,6 +37,7 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, allStarterBundles } = require('../starter-bundles');
+const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -1282,6 +1284,33 @@ module.exports = function provisioningRoutes() {
     res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles() });
   });
 
+  // GET /provisioning/recommendations?type=<project type>&team_shape=<interview answer>
+  // — the RULE-BASED recommendation for one set of creation answers (BV1.R17, task
+  // 1002336; goal 1000046 criteria `proj-module-select`, `proj-governance-reco`,
+  // `proj-invite-builders`). Returns `{ recommendations: { type, teamShape, tailored,
+  // bundle, governance, invites } }` — the starter bundle adjusted by the interview
+  // answer with a `reason` per adjustment, a named governance preset with its preview
+  // (`applied: false` until the governance module ships, goal 1000030), and the invite
+  // SEEK that R28 (task 1002347) turns into names.
+  //
+  // The two answers arrive separately because they are stored separately: `type` is a
+  // column and `team_shape` a key of the `detail` jsonb, so a caller passes back
+  // exactly what it holds. Both are optional and neither is validated by rejection —
+  // an absent or off-vocabulary value reads as NO ANSWER and yields the stated
+  // defaults, which is the supported path (ADR 0182 D4: skipping the interview is a
+  // real answer), never a 400.
+  //
+  // A pure read over modules/provisioning/recommendations.js — no database, no
+  // per-request state. rank: public — the same absent gate as `starter-bundles` and
+  // `onboard-plan` above: the signed-out hub wizard (/projects?view=new) asks while
+  // the owner is still answering, before any row exists to be own-scoped against, and
+  // the answer is a declaration that names nothing private.
+  router.get('/provisioning/recommendations', (req, res) => {
+    const type = typeof req.query.type === 'string' ? req.query.type : null;
+    const teamShape = typeof req.query.team_shape === 'string' ? req.query.team_shape : null;
+    res.json({ recommendations: recommendationsForDetails({ type, team_shape: teamShape }) });
+  });
+
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST
   // (ADR 0111 §4, task P4 #1945). Caddy's global `on_demand_tls { ask … }` calls
   // this before fetching a Let's Encrypt cert for an SNI it doesn't already have:

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.512",
+  "version": "1.19.514",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.512",
+      "version": "1.19.514",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.512",
+  "version": "1.19.514",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.512'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.514'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_audit.mjs

@@ -236,6 +236,90 @@ test('the session log pages on the kit — the last hand-roll is gone', () => {
   assert.match(read('sessions.html'), /hall-kit\.js/, 'and the page has to load the kit');
 });
 
+// ---- 6b. every hall bar series is drawn by the kit (task 1003445) ---------
+
+test('the kit is the ONLY thing in the hall that draws a bar series', () => {
+  // Charts were the one primitive the kit never got, and the hard rule in
+  // hall-ui/CLAUDE.md names pager/filter/tab/rail and stops — so the same
+  // horizontal bar got written THREE times, each with its own class family:
+  // the Curve's kinds (hall-render.js), Watch's Review-quality trend
+  // (watch.js) and the profile's craft mix (profile-charts.js `mixChart`).
+  // Nothing failed when the third copy landed, which is the whole reason this
+  // check exists rather than a sentence in a doc.
+  //
+  // Two halves, because one alone is escapable.
+  //
+  // (a) OWNERSHIP, the pager rule's own idiom: the kit stamps `.kit-bars` /
+  //     `.kit-spark` at runtime and callers pass DATA, so the class appearing
+  //     in another file is by construction a second implementation.
+  const OWNER = 'hall-kit.js';
+  const stamped = [];
+  for (const f of fs.readdirSync(HALL)) {
+    if (!/\.(html|js)$/.test(f) || f === OWNER) continue;
+    if (/class="kit-(?:bars|spark|plot)[\s"_-]/.test(read(f))) stamped.push(f);
+  }
+  assert.deepEqual(stamped, [],
+    `${stamped.join(', ')} writes the kit's own chart classes by hand — call `
+    + 'OTBKit.barSeriesHtml / sparklineHtml / plotSvgHtml instead.');
+
+  // No page may draw an SVG series of its own either — a <path>/<rect>/
+  // <polyline> built in a template string IS chart drawing, whatever it is
+  // classed. This is what the narc caught on the first round: the bars were
+  // unified while two hand-rolled SVG charts stayed behind.
+  const svgDrawers = [];
+  for (const f of fs.readdirSync(HALL)) {
+    if (!/\.js$/.test(f) || f === OWNER) continue;
+    const src = read(f);
+    if (/<(?:path|polyline|rect)\b[^>]*\b(?:d|points)="\$\{/.test(src)) svgDrawers.push(f);
+  }
+  assert.deepEqual(svgDrawers, [],
+    `${svgDrawers.join(', ')} builds SVG series geometry by hand — the kit owns the `
+    + 'shapes (timeStepSeriesHtml, columnSeriesHtml, sparklineHtml) and plotSvgHtml owns '
+    + 'the axis frame; a page composes them and wires its own readout.');
+
+  // (b) SHAPE, so a SEVENTH copy under a fresh class family is caught too —
+  //     which (a) alone would miss, and which is exactly how copies two and
+  //     three arrived. A bar series is a percentage-width fill inside a
+  //     track/bar/fill-named element.
+  //
+  //     The allowlist is METERS, not series, and the distinction is real: a
+  //     meter shows ONE value against a fixed 0-100 scale (and bands it), a
+  //     series shows several values against each other's computed max. The kit
+  //     draws the second; folding the first into it would mean inventing a
+  //     scale the meter does not have. Adding a name here is where the
+  //     conversation happens — do not add one to make a chart pass.
+  const METERS = new Set([
+    'idea.js',   // .ig-score — one Full-Idea completeness gauge, banded full/part/thin
+    'ideas.js',  // .fi-mrow  — the composer's per-field completeness, driven imperatively
+  ]);
+  const handRolled = [];
+  for (const f of fs.readdirSync(HALL)) {
+    if (!/\.js$/.test(f) || f === OWNER || METERS.has(f)) continue;
+    const src = read(f);
+    if (/class="[^"]*(?:__|-)(?:fill|bar|track)[^"]*"[^>]*style="width:/.test(src)) handRolled.push(f);
+  }
+  assert.deepEqual(handRolled, [],
+    `${handRolled.join(', ')} draws a bar series by hand — call OTBKit.barSeriesHtml(rows, opts). `
+    + 'Geometry and tone are options (labelWidth/valueWidth/barHeight/radius/track/tone), so a new '
+    + 'chart needs no new drawing code and no new class family.');
+});
+
+test('the three bar copies are gone, and their class families with them', () => {
+  // The specific copies this rule replaced, pinned by name so their return is
+  // loud. Behaviour is exercised for real in tests/hall_kit_charts.mjs.
+  // Comments stripped: each sheet keeps a line SAYING which family it retired,
+  // and a substring check would read that sentence as the family still living.
+  const css = ['style.css', 'watch.css', 'profile.css']
+    .map((f) => read(f).replace(/\/\*[\s\S]*?\*\//g, '')).join('\n');
+  for (const dead of ['curve__kind-', 'curve__chart', 'watch-trend', 'pmix']) {
+    assert.ok(!css.includes(dead), `${dead} is the kit's .kit-bars/.kit-chart now`);
+  }
+  assert.match(read('hall-render.js'), /OTBKit\.barSeriesHtml\(/, 'the Curve\'s kinds draw through the kit');
+  assert.match(read('watch.js'), /OTBKit\.barSeriesHtml\(/, 'Watch\'s trend draws through the kit');
+  assert.match(read('profile-charts.js'), /OTBKit\.barSeriesHtml\(/, 'the craft mix draws through the kit');
+  assert.match(read('hall-render.js'), /OTBKit\.sparklineHtml\(/, 'and the Curve\'s line does too');
+});
+
 test('the peer-recognition feed is paged through OTBKit, not by hand', () => {
   assert.match(read('hall-widgets.js'), /pagerBarHtml\('acclaim'/, 'the acclaim card stamps the kit pager bar');
   const js = read('builders.js');