@bongos/core 1.19.562 → 1.19.563

package/tests/one_planning_version.mjs

@@ -0,0 +1,161 @@
+// tests/one_planning_version.mjs — exactly one version plans at a time
+// (BV1.R04, task 1003592, goal 1000086, ADR 0250 D5).
+//
+// WHY THIS EXISTS AT ALL. On its own the rule looks like housekeeping. It is the
+// second half of R03: once a building version's goal set is closed, the first
+// thing a refused caller reaches for is a NEW version to put the goal on — and
+// the scope gate becomes decorative. One planning version means one queue for
+// future work and no parallel escape hatch.
+//
+// Scope, stated so the next reader does not think it was forgotten: this guards
+// the PLANNING slot only. Creating a `shipped` or `frozen` version is archival
+// bookkeeping. Refusing a second BUILDING version is D5's other half and belongs
+// to task 1003606 (R19).
+//
+// The rule is a pure predicate (`authorizeVersionCreate`, the `authorizeGoalCreate`
+// precedent), so it is EXERCISED here rather than string-matched — including the
+// shapes a live-Postgres test would never set up. The route's own write path stays
+// covered by versions_route.mjs against real Postgres; what is checked of the route
+// here is only the wiring, which is all the route now contains.
+//
+// Run:  node --test tests/one_planning_version.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { versionsWithStatus } = require('../modules/lifecycle/db.js');
+const { authorizeVersionCreate } = require('../modules/lifecycle/routes/version-route-authz.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const V2 = { id: 'BONGOS-V2', name: 'Next' };
+const V3 = { id: 'BONGOS-V3', name: 'After' };
+
+function fakePool(rows) {
+  const c = makeSqlAwareClient(() => ({ rows }));
+  return { query: (sql, p) => c._client.query(sql, p), connect: c.connect, queries: c._client.queries };
+}
+
+// ---- the decision, exercised ------------------------------------------------
+
+test('the planning slot is free → allowed', () => {
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: [] }), { ok: true });
+});
+
+test('the planning slot is taken → named 409 that says which version has it', () => {
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2] });
+  assert.equal(d.ok, false);
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'planning_version_exists');
+  assert.match(d.body.message, /BONGOS-V2/,
+    'a caller who has to go look up which version is one step from cutting one');
+  assert.deepEqual(d.body.planning, [V2], 'and the rows travel with the refusal');
+});
+
+test('creating a shipped, frozen or building version is untouched', () => {
+  // Archival bookkeeping must not be caught by a rule about the future queue,
+  // even while a planning version exists.
+  for (const status of ['shipped', 'frozen', 'building']) {
+    assert.deepEqual(authorizeVersionCreate({ status, planning: [V2] }), { ok: true },
+      `'${status}' is not the planning slot`);
+  }
+});
+
+test('more than one planning version already present → still refuses, names the first', () => {
+  // The state this rule exists to prevent may already exist (the cutover is R28).
+  // The gate must not throw or wave it through on the way to fixing it.
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2, V3] });
+  assert.equal(d.body.error, 'planning_version_exists');
+  assert.equal(d.body.planning.length, 2, 'the caller sees the full mess, not a sample');
+});
+
+test('a missing or malformed planning list does not crash the gate', () => {
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning' }), { ok: true },
+    'omitted defaults to empty — the route only reads when status is planning');
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: null }), { ok: true });
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: [null, undefined] }), { ok: true },
+    'empty-after-filtering is empty; a falsy row must not become a phantom refusal');
+});
+
+test('the refusal is data, not a rendered string the route has to parse', () => {
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2] });
+  assert.deepEqual(Object.keys(d).sort(), ['body', 'ok', 'status']);
+  assert.ok(typeof d.body.error === 'string' && typeof d.status === 'number');
+});
+
+// ---- the read ---------------------------------------------------------------
+
+test('versionsWithStatus binds the status and returns id + name only', async () => {
+  const pool = fakePool([V2]);
+  const out = await versionsWithStatus('planning', { pool });
+  assert.deepEqual(out, [V2]);
+  assert.match(String(pool.queries[0].sql), /SELECT id, name FROM versions WHERE status = \$1/);
+  assert.deepEqual(pool.queries[0].params, ['planning'], 'the status is bound, not interpolated');
+});
+
+test('no planning version reads as an empty list, not a null', async () => {
+  assert.deepEqual(await versionsWithStatus('planning', { pool: fakePool([]) }), [],
+    'and the gate treats empty as allowed, closing the loop between read and decision');
+});
+
+// ---- the wiring, which is all the route now carries -------------------------
+
+const ROUTE = (() => {
+  const s = src('modules/lifecycle/routes/versions.js');
+  const a = s.indexOf("router.post('/versions'");
+  assert.notEqual(a, -1, 'POST /versions not found');
+  const b = s.indexOf('router.', a + 20);
+  return s.slice(a, b === -1 ? s.length : b);
+})();
+
+test('the route renders the decision and does not carry the rule', () => {
+  assert.match(ROUTE, /const versionDecision = authorizeVersionCreate\(\{/);
+  assert.match(ROUTE, /return res\.status\(versionDecision\.status\)\.json\(versionDecision\.body\);/);
+  assert.equal(/planning_version_exists/.test(ROUTE), false,
+    'the refusal is the gate\'s to name, not a second copy in the handler');
+});
+
+test('the route reads the planning versions ONLY when it could matter', () => {
+  // Creating a shipped version must not pay for a query about the planning queue.
+  assert.match(ROUTE, /status === 'planning' \? await db\.versionsWithStatus\('planning'\) : \[\]/);
+});
+
+test('the gate runs AFTER validation and BEFORE the insert', () => {
+  const badStatus = ROUTE.indexOf("'bad_status'");
+  const exists = ROUTE.indexOf("'version_exists'");
+  const gate = ROUTE.indexOf('authorizeVersionCreate');
+  const write = ROUTE.indexOf('db.createVersion');
+  assert.ok(badStatus !== -1 && exists !== -1 && gate !== -1 && write !== -1);
+  assert.ok(badStatus < gate, 'an invalid status is its own answer, not a queue conflict');
+  assert.ok(exists < gate, 'a duplicate id keeps its own answer too');
+  assert.ok(gate < write, 'a refusal after the insert is not a refusal');
+});
+
+test('the default status is planning, so an unqualified create hits the gate', () => {
+  // The body may omit `status`. If that default ever changed, the gate would
+  // silently stop applying to the most common call.
+  assert.match(ROUTE, /const status = body\.status \|\| 'planning';/);
+});
+
+test('the accepted race is described as unmitigated, because it is', () => {
+  // An earlier draft of this comment said the race was "left to a partial unique
+  // index" — which reads as though one exists. It does not, and a future reader
+  // taking that at face value would believe two concurrent creates cannot both
+  // slip through. Pinned so the honest wording cannot quietly regress.
+  assert.match(ROUTE, /RACE, ACCEPTED AND UNMITIGATED/);
+  assert.match(ROUTE, /no database\s*\n?\s*\/\/ constraint backs it/,
+    'the comment must say plainly that nothing catches it');
+});
+
+// ---- the rule is one half of a pair ----------------------------------------
+
+test('R03 and R04 are the pair: closing the goal set, and closing the way around it', () => {
+  assert.match(src('modules/lifecycle/routes/goal-route-authz.js'), /function authorizeGoalCreate/,
+    'R03 closes a building version\'s goal set');
+  assert.equal(authorizeVersionCreate({ status: 'planning', planning: [V2] }).ok, false,
+    'and R04 closes the obvious route around it — neither is much use alone');
+});

package/tests/project_invite_suggestions.mjs

@@ -0,0 +1,133 @@
+// tests/project_invite_suggestions.mjs — WHO the creation wizard suggests
+// inviting (BV1.R28, task 1002347, goal 1000046 criterion C6, ADR 0251).
+//
+// tests/project_invite_ui.mjs pins the SURFACE (how a suggestion renders and what
+// clicking it sends). This file pins the LOOKUP behind it, and above all the two
+// properties that are security rather than behaviour:
+//
+//   • it reads the RECRUITING DIRECTORY, not the leaderboard — so the recruiting
+//     opt-out is honoured. The two readers differ by exactly one SQL predicate
+//     and the wrong one would hand an owner the name of every builder who asked
+//     not to be recruited (community spec D3; see scoutingListableSql).
+//   • `github_id` never leaves the module — the invite route takes a LOGIN, and
+//     the id names someone who has consented to nothing.
+//
+// Run:  node --test --test-reporter=tap tests/project_invite_suggestions.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+// ESM named import off the CJS module: knip cannot trace a createRequire()
+// import, so a test-only export would read as dead code and move the ratchet.
+import { listInviteSuggestions } from '../modules/platform-identity/invite-suggestions.js';
+
+// A pool that records the SQL it was handed and replays canned rows.
+function fakePool(rows) {
+  const seen = [];
+  return {
+    seen,
+    query: async (text, params) => {
+      seen.push({ text, params });
+      return { rows };
+    },
+  };
+}
+
+const BUILDERS = [
+  { github_id: 1, github_login: 'ada', display_name: 'Ada L', avatar_url: 'a.png', disciplines: ['engineer'], project_count: 3, total_tasks_shipped: 40, total_credits: 900 },
+  { github_id: 2, github_login: 'grace', display_name: 'Grace H', avatar_url: 'g.png', disciplines: ['engineer'], project_count: 2, total_tasks_shipped: 30, total_credits: 800 },
+  { github_id: 3, github_login: 'linus', display_name: null, avatar_url: null, disciplines: null, project_count: 1, total_tasks_shipped: 10, total_credits: 100 },
+];
+
+test('it reads the RECRUITING directory — the consent predicate is in the query it runs', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 3, pool });
+
+  // Assert — the opt-out axis (`recruiter_reach`/opt-out columns via
+  // scoutingListableSql) must appear in the SQL. A leaderboard read would join
+  // rollupVisibleSql instead and quietly include opted-out builders.
+  const sql = pool.seen[0].text;
+  assert.match(sql, /platform_identity_builder_project_activity/, 'the cross-project activity rollup, not the credits ledger');
+  assert.match(sql, /platform_identity_accounts/, 'joined to accounts for the consent predicate');
+  assert.doesNotMatch(sql, /FROM\s+builders\b/, 'never the instance leaderboard table');
+});
+
+test('github_id never crosses the boundary — the caller gets the login, which is what an invite takes', async () => {
+  // Act
+  const out = await listInviteSuggestions({ limit: 3, pool: fakePool(BUILDERS) });
+
+  // Assert
+  assert.equal(out.length, 3);
+  for (const row of out) {
+    assert.ok(!('github_id' in row), 'no github_id on a suggestion');
+    assert.ok(row.github_login, 'the login IS the address the invite route takes');
+  }
+  assert.deepEqual(Object.keys(out[0]).sort(),
+    ['avatar_url', 'disciplines', 'display_name', 'github_login', 'project_count', 'total_tasks_shipped'],
+    'an explicit whitelist, so a new column on the rollup cannot leak by default');
+});
+
+test('the owner is dropped from their own suggestions, and the list still fills', async () => {
+  // Act — ada (1) is the owner asking
+  const out = await listInviteSuggestions({ limit: 2, exclude: [1], pool: fakePool(BUILDERS) });
+
+  // Assert
+  assert.deepEqual(out.map((r) => r.github_login), ['grace', 'linus'],
+    'the owner is gone and the next builder moved up — the limit is still met');
+});
+
+test('the over-read is sized to the exclusion, so filtering can never return short', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 3, exclude: [1, 2], pool });
+
+  // Assert
+  assert.equal(pool.seen[0].params[0], 5, 'asked for limit + the two it may have to drop');
+});
+
+test('a limit of zero asks the database nothing at all', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  const out = await listInviteSuggestions({ limit: 0, pool });
+
+  // Assert
+  assert.deepEqual(out, []);
+  assert.equal(pool.seen.length, 0, 'no seek, no query — the solo answer costs nothing');
+});
+
+test('the limit is clamped, so a caller cannot turn a suggestion into a directory dump', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 9999, pool });
+
+  // Assert
+  assert.equal(pool.seen[0].params[0], 25, 'clamped to the ceiling');
+});
+
+test('a row with no login is dropped — it cannot be invited, so it is not a suggestion', async () => {
+  // Act
+  const out = await listInviteSuggestions({
+    limit: 5,
+    pool: fakePool([{ github_id: 9, github_login: null, display_name: 'Ghost' }, ...BUILDERS]),
+  });
+
+  // Assert
+  assert.deepEqual(out.map((r) => r.github_login), ['ada', 'grace', 'linus']);
+});
+
+test('a missing disciplines array reads as empty rather than null', async () => {
+  // Act
+  const out = await listInviteSuggestions({ limit: 5, pool: fakePool(BUILDERS) });
+
+  // Assert — linus has disciplines: null on the row
+  assert.deepEqual(out[2].disciplines, [], 'the surface can map() it without a guard');
+});

package/tests/project_invite_ui.mjs

@@ -48,7 +48,8 @@ const END = SCRIPT.indexOf('/* ── boot: who am I');
 assert.ok(START > 0, 'the invite region must start at INVITE_MOUNTS');
 assert.ok(END > START, 'the invite region must end before the boot block');
 const REGION = SCRIPT.slice(START, END);
-for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function skipInvite(', 'function inviteRefusal(']) {
+for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function skipInvite(', 'function inviteRefusal(',
+  'function setInviteSuggestions(', 'function renderInviteSugg(', 'function loadInviteSuggestions(']) {
   assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
 }
 
@@ -59,24 +60,43 @@ for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function ski
 const ROW = /<li><b>([^<]*)<\/b><small>([^<]*)<\/small><\/li>/g;
 const parseRows = (html) => [...String(html).matchAll(ROW)].map((m) => ({ login: m[1], said: m[2] }));
 
+// A suggestion row: whatever the row NAMES, plus the login its button carries.
+// Parsed off the button so the test reads the address the click will actually
+// send, not the label a row happened to render.
+const SUGG = /<li><span class="suggWho">(.*?)<\/span><button [^>]*data-invite-pick="([^"]*)"[^>]*>/g;
+const parseSugg = (html) => [...String(html).matchAll(SUGG)].map((m) => ({ named: m[1], login: m[2] }));
+
 function boot({ mount = 'wizInvite', answers = [] } = {}) {
   const requests = [];
   const els = new Map();
   const listeners = new Map();          // "elId:type" → [fn]
   const focused = [];
 
-  const makeEl = (id) => ({
-    _id: id, _html: '', textContent: '', className: '', value: '', hidden: false,
-    set innerHTML(v) { this._html = String(v); },
-    get innerHTML() { return this._html; },
-    addEventListener(type, fn) {
-      const key = id + ':' + type;
-      if (!listeners.has(key)) listeners.set(key, []);
-      listeners.get(key).push(fn);
-    },
-    setAttribute() {},
-    focus() { focused.push(id); },
-  });
+  const makeEl = (id) => {
+    const classes = new Set();
+    return {
+      _id: id, _html: '', textContent: '', className: '', value: '', hidden: false,
+      _classes: classes,
+      set innerHTML(v) { this._html = String(v); },
+      get innerHTML() { return this._html; },
+      // task 1002347 (R28): the suggestion surface shows its reason line the
+      // .modWhy way — a class toggle, not a hidden flag — so the stub grows the
+      // one DOM affordance that answer needs.
+      classList: {
+        toggle(name, on) { if (on) classes.add(name); else classes.delete(name); },
+        add(name) { classes.add(name); },
+        remove(name) { classes.delete(name); },
+        contains(name) { return classes.has(name); },
+      },
+      addEventListener(type, fn) {
+        const key = id + ':' + type;
+        if (!listeners.has(key)) listeners.set(key, []);
+        listeners.get(key).push(fn);
+      },
+      setAttribute() {},
+      focus() { focused.push(id); },
+    };
+  };
   const $ = (id) => {
     if (id == null) return null;
     if (!els.has(id)) els.set(id, makeEl(id));
@@ -86,7 +106,9 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   // Every mount's elements exist before the region wires them, exactly as the
   // real page has them: the script runs at the end of <body>.
   ['wizInvite', 'wizInviteWho', 'wizInviteList', 'wizInviteMsg', 'wizInviteLater', 'doneStepsHead',
-    'mInvite', 'mInviteWho', 'mInviteList', 'mInviteMsg'].forEach($);
+    'wizInviteWhy', 'wizInviteSugg',
+    'mInvite', 'mInviteWho', 'mInviteList', 'mInviteMsg',
+    'mInviteWhy', 'mInviteSugg'].forEach($);
 
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
@@ -113,19 +135,20 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   vm.runInContext(REGION, sandbox, { filename: 'projects.html#project-invite' });
 
   const mounts = {
-    wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg' },
-    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg' },
+    wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', why: 'wizInviteWhy', sugg: 'wizInviteSugg' },
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', why: 'mInviteWhy', sugg: 'mInviteSugg' },
   };
   const m = mounts[mount];
   const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
 
+  let pickLogin = '';
   const press = async (marker) => {
     const handlers = listeners.get(mount + ':click') || [];
     assert.equal(handlers.length, 1, 'the mount wires exactly one delegated click handler');
     handlers[0]({
       target: {
-        closest: (sel) => (sel === '[data-invite-send],[data-invite-skip]'
-          ? { hasAttribute: (a) => a === marker }
+        closest: (sel) => (sel === '[data-invite-send],[data-invite-skip],[data-invite-pick]'
+          ? { hasAttribute: (a) => a === marker, getAttribute: () => pickLogin }
           : null),
       },
     });
@@ -142,6 +165,13 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
     async type(login) { $(m.who).value = login; },
     async send() { await press('data-invite-send'); },
     async skip() { await press('data-invite-skip'); },
+    // ── the suggestion half (task 1002347, BV1.R28) ──────────────────────
+    why: () => $(m.why),
+    whyOn: () => $(m.why)._classes.has('on'),
+    suggested: () => parseSugg($(m.sugg).innerHTML),
+    async suggest(payload) { sandbox.setInviteSuggestions(mount, payload); await settle(); },
+    async load(instanceId) { sandbox.loadInviteSuggestions(mount, instanceId); await settle(); },
+    async pick(login) { pickLogin = login; await press('data-invite-pick'); },
     async enter() {
       const handlers = listeners.get(m.who + ':keydown') || [];
       assert.equal(handlers.length, 1, 'the field takes Enter');
@@ -500,3 +530,126 @@ test('the manage view has a rendered state for the invite line', () => {
   assert.ok(states['in-manage-invite'], 'the section has a kit state');
   assert.deepEqual(states['in-manage-invite'].expect.visible, ['#mInvite', '#mInvite h2', '#mInviteWho', '#mInvite [data-invite-send]']);
 });
+
+// ── who is worth inviting (task 1002347, BV1.R28, ADR 0251) ──────────────────
+// The engine states WHAT to look for and never who (ADR 0239 §6); these are the
+// names, and the rules they must not break: the reason is always said, "nobody"
+// is an answer rather than a blank, and a picked name takes the SAME write path
+// as a typed one.
+
+test('a suggestion list renders its names, and each row carries the login its button will send', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({
+    suggested: [
+      { github_login: 'ada', display_name: 'Ada L', total_tasks_shipped: 12, project_count: 3 },
+      { github_login: 'grace', display_name: null, total_tasks_shipped: 0, project_count: 0 },
+    ],
+    seeking: { kind: 'top-builders', limit: 3 },
+    reason: 'A small team is the shape that fills fastest.',
+  });
+  assert.deepEqual(h.suggested().map((r) => r.login), ['ada', 'grace']);
+  assert.match(h.suggested()[0].named, /Ada L/, 'a display name is used when the row carries one');
+  assert.match(h.suggested()[0].named, /@ada/, 'and the login is still shown — it is the address');
+  assert.match(h.suggested()[1].named, /<b>@grace<\/b>/, 'with no display name the login stands alone');
+});
+
+test('the reason is ALWAYS said — including when the answer is nobody', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({ suggested: [], seeking: null, reason: 'You said you are building alone, so nobody is suggested.' });
+  assert.equal(h.suggested().length, 0, 'no names');
+  assert.equal(h.why().textContent, 'You said you are building alone, so nobody is suggested.');
+  assert.ok(h.whyOn(), 'and the line is shown — "nobody" is an answer, not a blank state');
+});
+
+test('no payload at all says nothing — a failed lookup must not invent a reason', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest(null);
+  assert.equal(h.suggested().length, 0);
+  assert.equal(h.why().textContent, '');
+  assert.ok(!h.whyOn(), 'the reason line is off entirely, not empty-but-present');
+});
+
+test('picking a suggestion sends exactly what typing that name would have sent', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({ suggested: [{ github_login: 'ada' }], seeking: { kind: 'top-builders', limit: 3 }, reason: 'r' });
+  await h.pick('ada');
+  const posts = h.requests.filter((r) => r.method === 'POST');
+  assert.equal(posts.length, 1, 'one invite, through the one write path');
+  assert.deepEqual(JSON.parse(posts[0].body), { client_id: 'mercury', github_login: 'ada' },
+    'the same body shape as a typed invite — the slug IS the client_id');
+});
+
+test('a name invited this session stops being suggested — the pending line is its receipt', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({ suggested: [{ github_login: 'ada' }, { github_login: 'grace' }], seeking: { kind: 'top-builders', limit: 3 }, reason: 'r' });
+  assert.equal(h.suggested().length, 2);
+  await h.pick('ada');
+  assert.deepEqual(h.suggested().map((r) => r.login), ['grace'], 'ada moved to the pending list and left the suggestions');
+  assert.deepEqual(h.rows().map((r) => r.login), ['ada'], 'and she is on the pending list exactly once');
+});
+
+test('switching the mount to another project drops the suggestions with the pending rows', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({ suggested: [{ github_login: 'ada' }], seeking: { kind: 'top-builders', limit: 3 }, reason: 'r' });
+  await h.open('venus');
+  assert.equal(h.suggested().length, 0, 'the names belonged to the project they were suggested for');
+  assert.ok(!h.whyOn(), 'and so did the reason');
+});
+
+test('the suggestions read is own-scoped by ADDRESS: it asks the instance route, with the session', async () => {
+  const h = boot({ answers: [{ ok: true, status: 200, body: { suggested: [{ github_login: 'ada' }], seeking: { kind: 'top-builders', limit: 3 }, reason: 'r' } }] });
+  await h.open('mercury');
+  await h.load(41);
+  const get = h.requests.find((r) => r.method === 'GET');
+  assert.equal(get.url, '/api/bongos/provisioning/instances/41/invite-suggestions');
+  assert.equal(get.credentials, 'same-origin', 'the cookie is the whole gate — the route 404s for anyone else');
+  assert.deepEqual(h.suggested().map((r) => r.login), ['ada']);
+});
+
+test('no instance id asks nothing at all', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.load('');
+  assert.equal(h.requests.filter((r) => r.method === 'GET').length, 0, 'no project, no question');
+});
+
+test('a refused or unreachable lookup is SILENT — a created project never looks broken over an extra', async () => {
+  for (const answer of [{ ok: false, status: 404, body: {} }, { reject: true }]) {
+    const h = boot({ answers: [answer] });
+    await h.open('mercury');
+    await h.load(41);
+    assert.equal(h.suggested().length, 0, 'no names');
+    assert.equal(h.msg().textContent, '', 'and NOT a word in the invite message line');
+  }
+});
+
+test('a suggestion never renders a github_id, and its name goes through the escaper', async () => {
+  const h = boot();
+  await h.open('mercury');
+  await h.suggest({
+    suggested: [{ github_login: 'x"><img src=x onerror=1>', display_name: '<b>bad</b>', github_id: 4242, total_tasks_shipped: 1 }],
+    seeking: { kind: 'top-builders', limit: 3 },
+    reason: 'r',
+  });
+  const html = h.sandbox.$('wizInviteSugg').innerHTML;
+  assert.doesNotMatch(html, /4242/, 'the id names someone who has accepted nothing');
+  assert.doesNotMatch(html, /<img/, 'the login is escaped inside the attribute it rides in');
+  assert.doesNotMatch(html, /<b>bad<\/b>/, 'and the display name is escaped in the body');
+});
+
+test('the suggestion surface is mounted on BOTH the wizard and the project page', () => {
+  assert.match(HUB, /<ul class="suggList" id="wizInviteSugg"><\/ul>/, 'the wizard mount');
+  assert.match(HUB, /<ul class="suggList" id="mInviteSugg"><\/ul>/, 'and the project page mount');
+  assert.match(SCRIPT, /loadInviteSuggestions\('wizInvite', \(me && created && created\.slug\) \? created\.id : ''\)/,
+    'the wizard asks keyed on the SAME created record the slug comes from (ADR 0249 §1)');
+  assert.match(SCRIPT, /loadInviteSuggestions\('mInvite', inst\.slug \? inst\.id : ''\)/,
+    'and the manage page asks with the id whose read already proved ownership');
+  assert.match(COSMOS, /\.suggList\{/, 'styled in cosmos.css like its sibling list');
+  assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>') + 1), /suggList/, 'not in the page head');
+});