@bongos/core 1.19.641 → 1.19.643

package/tests/claude_materialize.mjs

@@ -255,6 +255,98 @@ t('disabledModuleSkills: only skills of DISABLED modules are collected (default
   rmSync(core, { recursive: true, force: true }); rmSync(inst, { recursive: true, force: true });
 });
 
+// ---- withdrawing a disabled module's skills on an EXISTING instance (task 1003632) ----
+// The bug: materializeClaude honoured `{"<key>": false}` on a FRESH instance (nothing
+// was copied) but only ever declined to COPY — so on an instance that already had the
+// files, `bongos upgrade` left them in .claude/skills/ for the harness to keep loading.
+// The withdrawal is PROVENANCE-GATED, which is the property that matters most here: a
+// skill the instance's owner wrote by hand is never in the manifest, so it must survive
+// even when a module declares the very same name.
+
+// Build a core with one module shipping two skills, and an instance with the module ON.
+function withdrawFixture() {
+  const core = mkdtempSync(join(tmpdir(), 'wd-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'wd-inst-'));
+  const modDir = join(core, 'modules', 'foo');
+  mkdirSync(join(modDir, 'skills', 'alpha'), { recursive: true });
+  mkdirSync(join(modDir, 'skills', 'beta'), { recursive: true });
+  mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['alpha', 'beta'] } }));
+  writeFileSync(join(modDir, 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nbody\n');
+  writeFileSync(join(modDir, 'skills', 'beta', 'SKILL.md'), '---\nname: beta\n---\nbody\n');
+  return { core, inst, modDir };
+}
+const disable = (inst, key) => {
+  mkdirSync(join(inst, 'config'), { recursive: true });
+  writeFileSync(join(inst, 'config', 'modules.json'), JSON.stringify({ modules: { [key]: false } }));
+};
+
+t('materializeClaude: a module disabled on an EXISTING instance has its skills WITHDRAWN, not left to linger', () => {
+  const { core, inst } = withdrawFixture();
+  // upgrade 1 — module on: both land, and provenance is recorded
+  const first = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.equal(first.moduleSkills, 2);
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md')));
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'beta', 'SKILL.md')));
+  assert.deepEqual(first.withdrawnSkills, [], 'nothing to withdraw on the way in');
+  const mani = m.readInstanceSkillsManifest(join(inst, '.claude', 'skills'));
+  assert.deepEqual(Object.keys(mani.skills).sort(), ['alpha', 'beta'], 'the run records what it landed');
+
+  // upgrade 2 — module off: THIS is the bug. Both dirs must go.
+  disable(inst, 'foo');
+  const second = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(second.withdrawnSkills, ['alpha', 'beta']);
+  assert.ok(!existsSync(join(inst, '.claude', 'skills', 'alpha')), 'alpha withdrawn');
+  assert.ok(!existsSync(join(inst, '.claude', 'skills', 'beta')), 'beta withdrawn');
+  assert.deepEqual(Object.keys(m.readInstanceSkillsManifest(join(inst, '.claude', 'skills')).skills), [], 'provenance now records nothing landed');
+
+  // upgrade 3 — idempotent: nothing left to withdraw, no throw on the absent dirs
+  const third = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(third.withdrawnSkills, []);
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('materializeClaude: a skill the module STOPPED declaring is withdrawn too', () => {
+  const { core, inst, modDir } = withdrawFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  // the module keeps only alpha
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['alpha'] } }));
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(res.withdrawnSkills, ['beta']);
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'alpha')), 'a still-declared skill stays');
+  assert.ok(!existsSync(join(inst, '.claude', 'skills', 'beta')));
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('materializeClaude: a HAND-WRITTEN skill is never withdrawn, even when a disabled module declares its name', () => {
+  const { core, inst } = withdrawFixture();
+  // The owner wrote .claude/skills/alpha themselves; no materialize ever landed it,
+  // so no manifest names it. Disabling foo must not touch it.
+  mkdirSync(join(inst, '.claude', 'skills', 'alpha'), { recursive: true });
+  writeFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), 'MINE — hand written\n');
+  disable(inst, 'foo');
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(res.withdrawnSkills, [], 'no provenance for it, so it is not ours to delete');
+  assert.equal(readFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), 'MINE — hand written\n', 'the owner\'s file is untouched');
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('materializeClaude: --dry-run reports the withdrawal without performing it; adopt mode declines to withdraw', () => {
+  const { core, inst } = withdrawFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  disable(inst, 'foo');
+
+  const dry = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: true });
+  assert.deepEqual(dry.withdrawnSkills, ['alpha', 'beta'], 'reports what it would withdraw');
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'alpha')), 'a dry run deletes nothing');
+
+  const adopt = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false, overwrite: false });
+  assert.deepEqual(adopt.withdrawnSkills, [], 'adopt never clobbers what the owner has');
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'alpha')));
+  assert.ok(adopt.notes.some((n) => /adopt mode does not withdraw/.test(n)), 'and says so');
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
 // ---- module-owned skills (task 1003321 / ADR 0198) ---------------------------
 // A module ships a skill from modules/<key>/skills/<name>/ (its own) or
 // modules/<key>/skills/vendor/<name>/ (third-party + PROVENANCE.md); only a DECLARED
@@ -473,6 +565,9 @@ t('--module-skills-only: an instance materialised FROM a core that carries mater
   assert.ok(res.moduleSkills >= 2, 'alpha landed through step 1b');
   assert.match(readFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), /bongos ship 1/, 'transformed on the way into the instance');
   for (const f of [m.MODULE_SKILLS_MANIFEST, '.gitignore']) assert.ok(!existsSync(join(inst, '.claude', 'skills', f)), `${f} is not shipped to an instance`);
+  // The instance writes its OWN provenance record under a different name (task 1003632)
+  // — it is not the core's dotfile leaking across the boundary the line above guards.
+  assert.ok(existsSync(join(inst, '.claude', 'skills', m.INSTANCE_SKILLS_MANIFEST)), 'the instance records what it landed, under its own filename');
   assert.ok(existsSync(join(inst, '.claude', 'skills', 'core-one', 'SKILL.md')) && existsSync(join(inst, '.claude', 'skills', 'shared', 'SKILL.md')), 'the core skills still land');
   rmSync(core, { recursive: true, force: true }); rmSync(inst, { recursive: true, force: true });
 });

package/tests/government_board_summons.mjs

@@ -200,6 +200,9 @@ test('pending votes are action_needed and deep-link the oldest sitting', () => {
   assert.equal(n.id, 'board_votes');
   assert.equal(n.state, 'action_needed');
   assert.equal(n.action.href, '/board-room?item=1');
+  // task 1003737: the number, machine-readable. The message has always carried it
+  // in prose, which a sentence can render and the nav badge cannot.
+  assert.equal(n.count, 9, 'the need states its count for a badge to read');
   // The item is a query param, because `/board-room` reads `?item=` and a
   // FRAGMENT would never reach the server (ADR 0266). The old
   // `/government…#board-room` form survives only as government.js's
@@ -207,6 +210,22 @@ test('pending votes are action_needed and deep-link the oldest sitting', () => {
   assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
+test('the founding grace keeps the count but drops the demand', () => {
+  // The badge keys on state, not on the number, precisely because of this: the
+  // grace rewrites the row to 'covered' and the count rides through the spread.
+  // A renderer keyed on `count` alone would shout through a new instance's
+  // first days, which is the one thing the grace exists to prevent.
+  const out = needs.computeNeeds({
+    rank: 'archon', ownKeySet: true,
+    pendingBoardVotes: { count: 5, first_item_id: '1' },
+    isFoundingOwner: true, founderCreatedAt: new Date().toISOString(),
+  });
+  const row = out.items.find((i) => i.id === 'board_votes');
+  assert.equal(row.count, 5, 'the count survives');
+  assert.equal(row.state, 'covered', 'but it is no longer a demand');
+  assert.equal(out.has_action_needed, false);
+});
+
 test('a count with no item id still links the room', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 2 } });
   assert.equal(n.action.href, '/board-room');

package/tests/government_rank_sync.mjs

@@ -326,3 +326,130 @@ test('the writer EXECUTES its plan: a custom rank survives a rank change', async
   const del = c.find(/DELETE FROM government_builder_ranks/);
   assert.deepEqual(del.params, [11, ['archon']]);
 });
+
+// ---------------------------------------------------------------------------
+// offboard + reactivation (task 1003193)
+// ---------------------------------------------------------------------------
+//
+// deactivateBuilder forces rank='xenos' by direct SQL — not through
+// setBuilderRank/_applyRankChangeTx, the only paths that rotated the role — so the
+// offboarded builder's OLD seeded rank-role survived in government_builder_ranks,
+// and getRankKeysForBuilder has no builders.status filter. The stale row is not a
+// live grant while they are inactive; REACTIVATION is the exposure, because
+// reactivateBuilder restores status='active' without touching rank, and a
+// reactivated ex-Archon sitting at builders.rank='xenos' then matches
+// getActiveBuildersWithRank / builderHoldsRankActive on the stale archon row.
+//
+// Asserted by EXECUTION, like the writer tests above: withTx is stubbed on
+// db-kernel BEFORE src/bongos/db.js is required (it destructures at load), the
+// government port is wired to the REAL syncRank, and both functions run against one
+// recording client — so the rotation being on the same transaction, and after the
+// rank write, is a fact about the code rather than a regex over it.
+
+const kernel = require(path.join(ROOT, 'src/bongos/db-kernel.js'));
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+if (!seams.hasProvider('government.rankSync')) {
+  seams.registerProvider('government.rankSync', { syncRank: govDb.syncRank });
+}
+
+// One client for the whole transaction: the builders/claims/sessions statements the
+// exit path issues AND the two government reads syncRank makes. Order the matchers
+// specific-first — the assignments read also names government_ranks (it joins it).
+function exitTxClient({ builderId, rank, status, held = [], newRank, newStatus }) {
+  const calls = [];
+  return {
+    calls,
+    find: (re) => calls.find((c) => re.test(c.sql)),
+    indexOf: (re) => calls.findIndex((c) => re.test(c.sql)),
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/INSERT INTO|DELETE FROM/.test(sql)) return { rows: [] };
+      if (/FROM government_builder_ranks br/.test(sql)) return { rows: held };
+      if (/FROM government_ranks/.test(sql)) return { rows: SEEDED };
+      if (/FROM builders WHERE id = \$1 FOR UPDATE/.test(sql)) {
+        return { rows: [{ id: builderId, rank, status }] };
+      }
+      if (/FROM claims/.test(sql)) return { rows: [] };
+      if (/UPDATE builders/.test(sql)) {
+        return { rows: [{ id: builderId, rank: newRank, status: newStatus }] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+let txClient = null;
+kernel.withTx = async (fn) => fn(txClient);
+const coreDb = require(path.join(ROOT, 'src/bongos/db.js'));
+
+test('offboarding an Archon removes the archon rank-role in the deactivation transaction', async () => {
+  txClient = exitTxClient({
+    builderId: 25, rank: 'archon', status: 'active',
+    held: [seededRank_('archon')], newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 25, reason: 'left the team', actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM government_builder_ranks/);
+  assert.ok(del, 'deactivateBuilder must rotate the seeded rank-role, not only write rank=xenos');
+  assert.deepEqual(del.params, [25, ['archon']], 'the stale archon assignment must be the row deleted');
+  const ins = txClient.find(/INSERT INTO government_builder_ranks/);
+  assert.deepEqual(ins.params, [25, ['xenos']], 'and the sandboxed rank-role takes its place');
+
+  assert.ok(txClient.indexOf(/DELETE FROM government_builder_ranks/) > txClient.indexOf(/UPDATE builders/),
+    'the rotation must follow the rank write inside the same transaction');
+});
+
+test('reactivation re-syncs the rank-role, so a stale-high role cannot come back live', async () => {
+  // The pre-fix residue: rank was forced to xenos but the archon assignment stayed.
+  // Flipping status back to 'active' is the moment it becomes a live grant again.
+  txClient = exitTxClient({
+    builderId: 25, rank: 'xenos', status: 'inactive',
+    held: [seededRank_('archon')], newRank: 'xenos', newStatus: 'active',
+  });
+  await coreDb.reactivateBuilder({ builderId: 25, actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM government_builder_ranks/);
+  assert.ok(del, 'reactivateBuilder must sync the rank-role to the row\'s current rank');
+  assert.deepEqual(del.params, [25, ['archon']],
+    'a reactivated ex-Archon must not resolve Archon permissions on the stale row');
+  assert.deepEqual(txClient.find(/INSERT INTO government_builder_ranks/).params, [25, ['xenos']]);
+});
+
+test('a consistent builder is reactivated with no government write at all', async () => {
+  // The sync is a repair, not a rewrite: it must not churn rows on every offboard
+  // round-trip once the assignment already agrees with builders.rank.
+  txClient = exitTxClient({
+    builderId: 26, rank: 'xenos', status: 'inactive',
+    held: [seededRank_('xenos'), customRank('release-manager')], newRank: 'xenos', newStatus: 'active',
+  });
+  await coreDb.reactivateBuilder({ builderId: 26, actorBuilderId: 3 });
+
+  assert.ok(!txClient.find(/(INSERT INTO|DELETE FROM) government_builder_ranks/),
+    'no rotation is due — and the custom rank must survive untouched');
+});
+
+test('a custom rank survives an offboard (only the seeded rank-role rotates)', async () => {
+  txClient = exitTxClient({
+    builderId: 27, rank: 'metic', status: 'active',
+    held: [seededRank_('metic'), customRank('release-manager')], newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 27, reason: null, actorBuilderId: 3 });
+
+  assert.deepEqual(txClient.find(/DELETE FROM government_builder_ranks/).params, [27, ['metic']],
+    'offboarding must never revoke an Archon-assigned custom rank');
+});
+
+test('both exit paths rotate the role on the transaction client, uncaught', async () => {
+  // The posture half, which execution cannot show: no try/catch around the call, so
+  // a rotation that cannot be written rolls the status change back with it.
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/db.js'), 'utf8');
+  for (const fn of ['deactivateBuilder', 'reactivateBuilder']) {
+    const body = src.slice(src.indexOf(`async function ${fn}(`));
+    const end = body.indexOf('\n}\n');
+    const scope = body.slice(0, end === -1 ? body.length : end);
+    const sync = scope.indexOf('await syncGovernanceRankRole(client');
+    assert.ok(sync !== -1, `${fn}: must rotate the seeded rank-role inside its transaction`);
+    assert.ok(!/try\s*{[\s\S]*syncGovernanceRankRole/.test(scope),
+      `${fn}: the rotation must not be swallowed — a failed rotation has to roll the write back`);
+  }
+});

package/tests/hall_nav.mjs

@@ -81,6 +81,31 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     return out;
   }
 
+  // task 1003737: the badge nodes applyCounts() settles. They are THE SAME
+  // element objects gatedNodes() hands back — keyed by the same id — because
+  // applyCounts reads `el.hidden`, which the gate loop is what sets. A separate
+  // stub object here would read a hidden that nothing ever wrote, and the
+  // "a badge never out-runs its gate" assertion would pass vacuously.
+  function countNodes() {
+    const html = els.has('app-sidebar') ? String(els.get('app-sidebar').innerHTML) : '';
+    const out = [];
+    for (const tag of html.split('<')) {
+      const count = attr(tag, 'data-count');
+      if (count === undefined) continue;
+      const key = attr(tag, 'id');
+      if (!gatedEls.has(key)) gatedEls.set(key, { key, dataset: {}, hidden: true });
+      const el = gatedEls.get(key);
+      el.dataset.count = count;
+      if (!el._badge) {
+        el._badge = { hidden: true, textContent: '' };
+        el._label = { textContent: '' };
+        el.querySelector = (sel) => (sel === '[data-badge]' ? el._badge : sel === '[data-badge-label]' ? el._label : null);
+      }
+      out.push(el);
+    }
+    return out;
+  }
+
   const documentObj = {
     body: { dataset: { page } },
     documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
@@ -88,7 +113,11 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
       if (!els.has(id)) els.set(id, makeEl());
       return els.get(id);
     },
-    querySelectorAll(sel) { return sel === '#app-sidebar [data-gate]' ? gatedNodes() : []; },
+    querySelectorAll(sel) {
+      if (sel === '#app-sidebar [data-gate]') return gatedNodes();
+      if (sel === '#app-sidebar .nav-item[data-count]') return countNodes();
+      return [];
+    },
     createElement() { return makeEl(); },
     addEventListener() {},
     dispatchEvent() {},
@@ -130,6 +159,14 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
       assert.ok(el, `nav item ${id} rendered`);
       return el.hidden;
     },
+    // task 1003737: what the badge on that item says right now — null when it is
+    // not showing, which is the state ZERO IS SILENT is about.
+    navBadge: (id) => {
+      const el = gatedEls.get('nav-' + id);
+      assert.ok(el, `nav item ${id} rendered`);
+      assert.ok(el._badge, `nav item ${id} declares a count`);
+      return el._badge.hidden ? null : { text: el._badge.textContent, label: el._label.textContent };
+    },
   };
 }
 
@@ -446,3 +483,115 @@ test('collapsible groups carry a stable storage key (collapse persistence)', ()
   assert.ok(!/nav-group--collapsible[^>]*>(?!<button)/.test(html.split('<div class="nav-group')[1] || ''),
     'the unlabeled project group stays always-expanded');
 });
+
+// ── a nav item can carry a COUNT badge (task 1003737) ───────────────────────
+//
+// The owner's ask: show that sittings wait on your vote WITHOUT going inside.
+// The count already rode /me (boardVotesNeed, pre-filtered to ballots this viewer
+// could actually cast); what the hall had was no badge/bell/dot mechanism of ANY
+// kind. These pin the MECHANISM, not the one consumer — the rules below are what
+// a second adopter (help requests, the idea inbox) inherits for free.
+
+const boardNeeds = (count, extra = {}) => ({
+  items: [{
+    id: 'board_votes', state: 'action_needed', count,
+    title: `${count} ideas are waiting on your vote`, ...extra,
+  }],
+});
+const seeingBoard = { authed: true, rank: 'xenos', permissions: { 'board.vote.cast': true } };
+
+test('THE ASK: a waiting sitting puts a count on the Board Room item', () => {
+  const b = boot();
+  b.shell.applyAccess({ ...seeingBoard, needs: boardNeeds(3) });
+  assert.deepEqual(b.navBadge('board-room'), { text: '3', label: '3 ideas are waiting on your vote' });
+});
+
+test('ZERO IS SILENT — and so is every other kind of nothing', () => {
+  // Five different nothings, one answer. A reader must not be able to tell an
+  // empty board from a /me that has not landed: both mean "nothing to act on".
+  const cases = {
+    'no needs key at all': undefined,
+    'needs is null (not yet told)': null,
+    'a roster with no board need': { items: [{ id: 'art_key', state: 'action_needed' }] },
+    'the need exists but counts zero': boardNeeds(0),
+    'a need carrying no count at all': { items: [{ id: 'board_votes', state: 'action_needed' }] },
+  };
+  for (const [name, needs] of Object.entries(cases)) {
+    const b = boot();
+    b.shell.applyAccess({ ...seeingBoard, needs });
+    assert.equal(b.navBadge('board-room'), null, `${name} → no badge`);
+  }
+});
+
+test('the founding grace silences the badge, because a badge is a demand', () => {
+  // computeNeeds rewrites every action_needed row to 'covered' during a new
+  // instance's first days, precisely so it does not greet its owner with demands.
+  // The count SURVIVES that rewrite (the grace spreads the row), so a badge keyed
+  // on the number alone would shout straight through the grace.
+  const b = boot();
+  b.shell.applyAccess({ ...seeingBoard, needs: boardNeeds(4, { state: 'covered' }) });
+  assert.equal(b.navBadge('board-room'), null, 'covered is not action_needed');
+});
+
+test('A BADGE NEVER OUT-RUNS ITS GATE — no count on a room you cannot see', () => {
+  // The disclosure rule. The count is real and the viewer holds no atom, so the
+  // item is hidden; the badge must not be written anyway. If it were, the DOM —
+  // and a screen reader walking it — would carry board activity to someone with
+  // no access to the room.
+  const b = boot();
+  b.shell.applyAccess({
+    authed: true, rank: 'archon', permissions: { 'board.vote.cast': false }, needs: boardNeeds(7),
+  });
+  assert.equal(b.navHidden('board-room'), true, 'precondition: the gate hides it');
+  assert.equal(b.navBadge('board-room'), null, 'a hidden item carries no count');
+});
+
+test('a badge already shown is CLEARED when access goes away', () => {
+  // The stale-count case: skipping hidden items rather than clearing them would
+  // leave the previous state's number sitting in the DOM after a sign-out.
+  const b = boot();
+  b.shell.applyAccess({ ...seeingBoard, needs: boardNeeds(2) });
+  assert.ok(b.navBadge('board-room'), 'precondition: it showed');
+  b.shell.applyAccess({ authed: false });
+  assert.equal(b.navBadge('board-room'), null, 'signing out takes the count with it');
+});
+
+test('a big count is capped rather than allowed to stretch the rail', () => {
+  const b = boot();
+  b.shell.applyAccess({ ...seeingBoard, needs: boardNeeds(140) });
+  assert.equal(b.navBadge('board-room').text, '99+');
+});
+
+test('the count reaches a screen reader as WORDS, not a floating numeral', () => {
+  // The numeral is aria-hidden decoration; the need's own sentence rides beside
+  // it in an sr-only span. "3" alone inside a link named Board Room says nothing.
+  const html = boot().sidebarHtml;
+  const item = html.split('<a class="nav-item"').find((t) => t.includes('id="nav-board-room"'));
+  assert.ok(item, 'the Board Room item renders');
+  assert.match(item, /class="nav-item__badge" data-badge aria-hidden="true" hidden/, 'the numeral is decoration');
+  assert.match(item, /class="sr-only" data-badge-label/, 'the words are what a reader gets');
+  // An item that declared no count grows neither node — the badge is opt-in.
+  const home = html.split('<a class="nav-item"').find((t) => t.includes('id="nav-home"'));
+  assert.ok(!/data-badge/.test(home), 'no count declared, no badge markup');
+});
+
+test('the mechanism is GENERIC — it keys on a declared need id, not on the board', () => {
+  // What makes a second consumer cheap: shell.js names a need id in `count:` and
+  // reads that row's number. Nothing in the badge path knows what a board IS, so
+  // adopting it is one field here plus one field on the need.
+  const fn = SRC.slice(SRC.indexOf('function applyCounts'), SRC.indexOf('// applyAccess({'));
+  assert.ok(fn.length > 0, 'applyCounts exists');
+  assert.ok(!/board/i.test(fn), 'the badge resolver names no specific need');
+  assert.match(fn, /dataset\.count/, 'it keys on the item’s own declared need id');
+});
+
+test('the badge is styled for BOTH shapes of the rail', () => {
+  // The rail is a 64px icon strip until hover/focus opens it, and the drawer is
+  // it permanently open with no hover to trigger anything. A badge positioned for
+  // one of the three reads wrong in the others, and no unit test would catch it.
+  const css = fs.readFileSync(path.join(HALL, 'style.css'), 'utf8');
+  assert.match(css, /\.nav-item__badge \{/, 'the collapsed (icon-only) position');
+  assert.match(css, /:focus-within \.nav-item__badge/, 'the open-rail position');
+  const drawer = css.slice(css.indexOf('html.drawer-open .app-sidebar'));
+  assert.match(drawer, /\.nav-item__badge \{ top: 50%/, 'the mobile drawer position');
+});

package/tests/rot_inbox.mjs

@@ -309,13 +309,89 @@ test('an unattributed thing is visible ONLY to canSeeAll — it has no creator t
     'a NULL creator must not be OR-ed into every builder\'s inbox');
 });
 
-test('each row carries the verbs for ITS tier, so the client never hardcodes the mapping', async () => {
-  expect({ rows: [rotRow(), rotRow({ tier: 'goal', id: '9' })] });
+test('each row carries the verbs for ITS tier AND ITS status, so the client never hardcodes the mapping', async () => {
+  expect({ rows: [rotRow(), rotRow({ tier: 'goal', id: '9', status: 'open' })] });
   const got = await rot.rottingFor({ builderId: 77, rotDays: 30 });
-  assert.deepEqual(got.rows[0].verbs.map((v) => v.verb), ['prioritise', 'prune', 'kill', 'water']);
+  // rotRow() is a BACKLOG task: promote accepts it, demote does not.
+  assert.deepEqual(got.rows[0].verbs.map((v) => v.verb), ['prioritise', 'kill', 'water']);
   assert.deepEqual(got.rows[1].verbs.map((v) => v.verb), ['kill', 'water']);
 });
 
+// ---- 4b. the offer must be the row's, not the tier's (task 1003751) ---------
+//
+// The regression this replaces: verbs were attached as `tier === 'task' ? TASK_VERBS
+// : GOAL_VERBS`, by tier only. Since TASK_ROTTABLE_STATUSES is exactly
+// ['backlog','ready'] and promote/demote accept disjoint sets, EVERY task line in
+// the feed shipped one button whose route answers 409 — a backlog row offered
+// Prune, a ready row offered Prioritise. The card's own header promises the
+// opposite ("the client renders what the server will actually accept").
+
+test('a backlog row is not offered Prune, and a ready row is not offered Prioritise', async () => {
+  expect({ rows: [rotRow({ status: 'backlog' }), rotRow({ id: '6', status: 'ready' })] });
+  const got = await rot.rottingFor({ builderId: 77, rotDays: 30 });
+  const backlog = got.rows[0].verbs.map((v) => v.verb);
+  const ready = got.rows[1].verbs.map((v) => v.verb);
+  assert.ok(!backlog.includes('prune'), "a backlog task is already at the bottom — /demote answers 409 cannot_demote");
+  assert.ok(backlog.includes('prioritise'), 'a backlog task is exactly what /promote is for');
+  assert.ok(!ready.includes('prioritise'), "a ready task is already claimable — /promote answers 409 cannot_promote");
+  assert.ok(ready.includes('prune'), 'ready is the only status /demote accepts');
+  // kill and water are unconditional across the rottable set, so no row loses them.
+  for (const offered of [backlog, ready]) {
+    assert.ok(offered.includes('kill') && offered.includes('water'),
+      'kill and water apply to every rottable row — narrowing must not drop them');
+  }
+});
+
+test('no verb is offered for a status its route would refuse, across the whole rottable set', () => {
+  // The end-to-end claim of this feature, checked against the route guards rather
+  // than against a second hardcoded list. Every status that can reach the feed,
+  // every verb attached to it, must name a route that accepts that status.
+  for (const status of rot.TASK_ROTTABLE_STATUSES) {
+    const offered = rot.verbsFor('task', status).map((v) => v.verb);
+    assert.ok(offered.length > 0, `status '${status}' was offered no verbs at all`);
+    for (const verb of offered) {
+      const accepts = rot.TASK_VERB_ACCEPTS[verb];
+      assert.ok(!accepts || accepts.includes(status),
+        `verb '${verb}' is offered on a '${status}' row but its route accepts only [${accepts}] — that button 409s`);
+    }
+  }
+});
+
+test('the accepted-status map is the one the ROUTES actually enforce', () => {
+  // The unavoidable-copy pairing guard, in the same spirit as the rot-clock check
+  // against migration core_231: rot.js must mirror routes/tasks.js, so read the
+  // guards back out of the route source and fail if they have drifted apart.
+  const TASKS_SRC = readFileSync(join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+
+  const promoteGuard = /if \(!\[([^\]]*)\]\.includes\(task\.status\)\)\s*\{\s*return res\.fail\('cannot_promote'/.exec(TASKS_SRC);
+  assert.ok(promoteGuard, "could not find /promote's status guard in routes/tasks.js — if it was reshaped, re-derive TASK_VERB_ACCEPTS.prioritise from the new shape");
+  const promoteAccepts = promoteGuard[1].split(',').map((x) => x.trim().replace(/^'|'$/g, '')).filter(Boolean);
+  assert.deepEqual(
+    [...rot.TASK_VERB_ACCEPTS.prioritise].sort(), promoteAccepts.sort(),
+    'TASK_VERB_ACCEPTS.prioritise no longer matches what POST /tasks/:id/promote accepts — the rot card would offer (or withhold) a Prioritise button wrongly'
+  );
+
+  const demoteGuard = /if \(task\.status !== '([^']+)'\)\s*\{\s*return res\.fail\('cannot_demote'/.exec(TASKS_SRC);
+  assert.ok(demoteGuard, "could not find /demote's status guard in routes/tasks.js — if it was reshaped, re-derive TASK_VERB_ACCEPTS.prune from the new shape");
+  assert.deepEqual(
+    [...rot.TASK_VERB_ACCEPTS.prune], [demoteGuard[1]],
+    'TASK_VERB_ACCEPTS.prune no longer matches what POST /tasks/:id/demote accepts'
+  );
+});
+
+test('every key in the accepted-status map is a real task verb', () => {
+  // A typo'd key would silently make its verb UNCONDITIONAL (absent = no filter),
+  // which is the exact bug this map exists to fix, reintroduced quietly.
+  const known = new Set(rot.TASK_VERBS.map((v) => v.verb));
+  for (const verb of Object.keys(rot.TASK_VERB_ACCEPTS)) {
+    assert.ok(known.has(verb), `'${verb}' is not a declared task verb — a stale key filters nothing`);
+  }
+});
+
+test('a goal row keeps both its verbs — neither goal route is status-conditional here', () => {
+  assert.deepEqual(rot.verbsFor('goal', 'open').map((v) => v.verb), ['kill', 'water']);
+});
+
 // ---- 5. the timer resolver: precedence + the reporting fail posture ---------
 
 test('no row anywhere = the documented default, and it says so', async () => {