@bongos/core 1.19.664 → 1.19.665

package/tests/hall_studio_world.mjs

@@ -28,15 +28,130 @@ const HTML = read('studio.html');
 const HTML_NC = HTML.replace(/<!--[\s\S]*?-->/g, '');
 const JS = read('studio.js');
 const CSS = read('studio.css');
+// The file's comments legitimately NAME routes and rules it must not call (the
+// header explains what the room does not do, and the allowlist documents each
+// entry), so the route invariants below scan the CODE. Comments only — string
+// contents are untouched, which is where a real route would live.
+const JS_NC = JS.replace(/^\s*\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
 
-test('the Studio writes NOTHING — the goal\'s no-live-CMS rule, at the surface', () => {
-  // Every craft act (coach the grader, remake copy, propose wording) happens on
-  // the surface that owns it (the task record, the copy desk) as a claimed,
-  // graded, shipped task. This room only READS and ROUTES. A POST/PATCH/DELETE
-  // here would be the live-CMS write path the goal forbids (criterion
-  // artist-edits-land-as-tasks) — so it must not exist.
-  const writes = JS.match(/\.request\(\s*['"](POST|PATCH|PUT|DELETE)['"]/g) || [];
-  assert.deepEqual(writes, [], `studio.js must issue no writes; found ${writes.join(', ')}`);
+// ---------------------------------------------------------------------------
+// What the room may write — NARROWED, not dropped (task 1003829).
+//
+// This test used to assert studio.js issued NO write at all. Task 1003829
+// relaxed that, deliberately and only this far: "The Studio's no-write posture
+// is relaxed only for the artist's own verdict on their own queue — it still
+// gates nothing and still holds no deploy." So the invariant becomes an
+// ALLOWLIST. The thing goal 1000074 actually forbids — a live CMS, a room that
+// edits a shipped string or asset — is what the second test below pins, and it
+// is the half that must never be relaxed again.
+// ---------------------------------------------------------------------------
+
+test('the Studio writes ONLY the artist\'s verdict on their own review queue', () => {
+  // Each permitted write moves the REVIEW TASK (dismiss it, note on it, file
+  // its follow-up and close it against that). Every one of them is a route the
+  // board's ordinary triage already had; none of them touches the product.
+  const allowed = [
+    /^POST \$\{API\}\/tasks\/\$\{reviewId\}\/abandon$/,  // looks good → dismissed
+    /^PATCH \$\{API\}\/tasks\/\$\{reviewId\}$/,          // note it   → the words, on the review
+    /^POST \$\{API\}\/tasks$/,                           // needs work→ the follow-up task
+    /^POST \$\{API\}\/tasks\/\$\{reviewId\}\/merge$/,    // …and the review closed against it
+  ];
+  // Every write site, as "<VERB> <route expression>" — the verb from the
+  // request call, the route from the WRITE_ROUTES entry it names.
+  const routes = new Map(
+    [...JS.matchAll(/^\s*(\w+):\s*\([^)]*\)\s*=>\s*`([^`]+)`,/gm)].map((m) => [m[1], m[2]])
+  );
+  // EVERY write site in the file, with the URL argument it was given — so a
+  // write cannot dodge the allowlist by naming its URL inline. That totality is
+  // what makes this test a wall and not a sample.
+  const sites = [...JS_NC.matchAll(/\.request\(\s*['"](POST|PATCH|PUT|DELETE)['"]\s*,\s*([^,)]+)/g)]
+    .map(([, verb, arg]) => {
+      const named = /^WRITE_ROUTES\.(\w+)\(/.exec(arg.trim());
+      return { verb, arg: arg.trim(), route: named ? routes.get(named[1]) : null };
+    });
+  assert.equal(sites.length, 4, `exactly the four verdict writes; found ${sites.length}`);
+  for (const s of sites) {
+    assert.ok(s.route, `every write names a WRITE_ROUTES entry, never an inline URL: ${s.verb} ${s.arg}`);
+    const site = `${s.verb} ${s.route}`;
+    assert.ok(allowed.some((re) => re.test(site)), `write outside the allowlist: ${site}`);
+  }
+});
+
+test('the Studio still edits no live string and no asset — the no-live-CMS rule', () => {
+  // The half that is NOT relaxed (criterion artist-edits-land-as-tasks). A copy
+  // change or an asset change reaches people only as a claimed, graded, shipped
+  // task, so this room must never call the routes that would write one directly.
+  const forbidden = [
+    /copy-desk\/proposals/,       // wording — belongs to the copy desk, under a claim
+    /copy-desk\/flags\/[^'"`]*\/close/,  // someone else's flag verdict — the copy desk's own act
+    /\/visual\b/,                 // POST/DELETE /tasks/:id/visual — the asset itself
+    /\/confirm\b/, /\/ship\b/, /\/grade\b/, /\/claims\b/,  // the ship pipeline: it gates nothing
+  ];
+  for (const re of forbidden) {
+    assert.ok(!re.test(JS_NC), `the Studio must not write ${re}`);
+  }
+  // "Needs work" files a TASK and says so: the follow-up is ordinary work that
+  // somebody claims, not an edit this room performs.
+  assert.match(JS, /never edits a live string or asset/, 'the follow-up brief says what the room did not do');
+});
+
+test('the verdict is offered only to a viewer the routes will accept', () => {
+  // The task 1003751 lesson: a card must not print a verb its route refuses.
+  // All four verdict routes floor at metic (modules/government/catalog.js), so
+  // the weights are drawn only above that floor and everyone else is told where
+  // the verdict is recorded instead. Cosmetic — ADR 0016, the server enforces.
+  assert.match(JS, /RANK_ORDER\.metic/, 'the offer is gated on the routes\' own floor');
+  assert.match(JS, /function canVerdict\(\)/, 'and the gate is one named predicate');
+  assert.match(JS, /if \(!canVerdict\(\)\)/, 'read both by the renderer and by the handler');
+  assert.match(JS, /studio-verdict__sealed/, 'a viewer below the floor gets a sentence, not three dead buttons');
+});
+
+test('the review card shows the reviewed work\'s picture, through the kit', () => {
+  // "the picture is the card" — and drawn by the kit's ONE full-size renderer
+  // rather than a third hand-rolled <figure> (the task's own instruction).
+  assert.match(JS, /kit\.taskVisualFigureHtml\(/, 'the plate comes from the kit renderer');
+  assert.ok(!/<figure/.test(JS), 'studio.js builds no <figure> of its own');
+  assert.match(HTML, /hall-kit\.js/, 'and the page loads the kit that owns it');
+  // The degrade: a review with no visual (or one that could not be read) draws
+  // nothing at all rather than an empty frame, so it still reads as a review.
+  assert.match(JS, /if \(!p\.shipped \|\| !kit/, 'no reviewed task, no kit → no plate');
+  // The reviewed task is read for the card in focus, once — not 50 times up front.
+  assert.match(JS, /p\.hydrated = true;/, 'the read is made once per review');
+  assert.match(JS, /\$\{API\}\/tasks\/\$\{encodeURIComponent\(p\.shippedId\)\}/, 'and it reads the SHIPPED task the review names');
+});
+
+test('a security_sensitive task\'s visual is suppressed, as the server suppresses it', () => {
+  // modules/lifecycle/task-visuals.js isPubliclyViewable makes a
+  // security_sensitive task's image the one visual the platform does not
+  // re-publish; the public feed's SQL agrees. The room agrees too — it keeps the
+  // id and drops the rest, so the card degrades to the copy it always showed.
+  assert.match(JS, /security_sensitive === true \? \{ id: t\.id \}/, 'the row is stripped to its id when it is sensitive');
+});
+
+test('a note APPENDS to a freshly-read brief — it can never blank one', () => {
+  // PATCH description REPLACES the field. Appending to a base that is stale, or
+  // that a narrowed list projection simply did not carry, would delete the
+  // cascade's brief instead of adding to it — so the base is re-read and the
+  // write is skipped entirely when that read fails.
+  assert.match(JS_NC, /const cur = await api\.request\('GET', `\$\{API\}\/tasks\/\$\{p\.taskId\}`\);/, 'the current brief is re-read');
+  assert.match(JS_NC, /if \(base === null\) \{/, 'and a failed re-read writes nothing');
+  assert.match(JS_NC, /description: `\$\{base\}\$\{block\}`/, 'the write is base + the note, in that order');
+  // Ordering, stated as code: the GET must precede the PATCH in the function.
+  const fn = /async function verdictNote[\s\S]*?\n  \}/.exec(JS_NC)[0];
+  assert.ok(fn.indexOf("request('GET'") < fn.indexOf("request('PATCH'"), 'read before write');
+});
+
+test('the three weights are the whole verdict, and two of them require words', () => {
+  // The room asks for nothing else (the task's DONE WHEN): one field, three
+  // answers. "looks good" may be wordless; a note with no note and a follow-up
+  // with no brief are refused inline rather than filed empty.
+  assert.match(JS, /const VERDICTS = \{ good: verdictGood, note: verdictNote, work: verdictWork \};/, 'exactly three weights');
+  assert.match(JS, /if \(!said\) return verdictError\('Write what you saw first/, 'a note needs words');
+  assert.match(JS, /if \(!said\) return verdictError\('Write what needs work first/, 'a follow-up needs a brief');
+  // The follow-up is idempotent on (source, source_ref), so a double-click
+  // resolves to the same task instead of filing two.
+  assert.match(JS, /source_ref: `studio-needs-work-on-review-\$\{p\.taskId\}`/, 'the follow-up is keyed for idempotency');
+  assert.match(JS, /let busy = false;/, 'and one verdict runs at a time');
 });
 
 test('the reviews read is bounded and correct', () => {
@@ -88,6 +203,318 @@ test('the accent is spent only where the rule allows', () => {
   assert.ok(accentFills.length <= 1, `studio.css spends the accent on at most the lamp; found ${accentFills.length}`);
 });
 
+// ---------------------------------------------------------------------------
+// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js beside it
+// (the bootShell pattern below, pointed at the page script). The static-source
+// assertions above pin the wiring; these render the card and read what it
+// actually says, which is the only way to pin a DEGRADE — "no picture" and
+// "picture suppressed" both have to produce a review that still reads as one.
+// ---------------------------------------------------------------------------
+// `onWrite` decides what each non-GET answers, so a test can drive the happy
+// path AND the refusals. Default: every write succeeds, and POST /tasks mints
+// NEW_TASK_ID so the "needs work" pair can be followed to its merge.
+const NEW_TASK_ID = '2001';
+async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags = null, onWrite = null } = {}) {
+  // The REAL kit, not a stub — the plate's URL guard and escaping are its code,
+  // and a stub here would make the degrade tests below pass for the wrong reason
+  // (no kit also means no plate). It is node-require-safe by its own contract.
+  const kit = (await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`)).default;
+  assert.equal(typeof kit.taskVisualFigureHtml, 'function', 'the real kit loaded');
+  const els = new Map();
+  const el = (id) => {
+    if (!els.has(id)) els.set(id, { id, innerHTML: '', textContent: '', hidden: false, value: '' });
+    return els.get(id);
+  };
+  const calls = [];
+  const request = async (method, url, body) => {
+    calls.push({ method, url, body });
+    if (method !== 'GET') {
+      const custom = onWrite && onWrite({ method, url, body });
+      if (custom) return custom;
+      if (/\/tasks$/.test(url)) return { ok: true, data: { task: { id: NEW_TASK_ID } } };
+      return { ok: true, data: { ok: true } };
+    }
+    if (/\/me$/.test(url)) return { ok: true, data: { builder: { display_name: 'Artist A', rank } } };
+    if (/\/tasks\?discipline=artist/.test(url)) return { ok: true, data: { tasks: reviews } };
+    if (/\/copy-desk\/queue/.test(url)) return flags ? { ok: true, data: { flags } } : { ok: false, data: {} };
+    // GET /tasks/:id answers for BOTH kinds of row the room reads by id: the
+    // reviewed (shipped) task the card's picture comes from, and the review
+    // itself, which "note it" re-reads before appending. `shipped` is the
+    // per-test control for the first; the queue rows serve the second, as the
+    // real route would. An id in neither is a 404, which is its own test.
+    const m = /\/tasks\/(\d+)$/.exec(url);
+    if (m && shipped[m[1]]) return { ok: true, data: { task: shipped[m[1]] } };
+    const review = m && reviews.find((r) => String(r.id) === m[1]);
+    if (review) return { ok: true, data: { task: review } };
+    return { ok: false, data: {} };
+  };
+  const handlers = [];
+  const window = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: {
+      escapeHtml: (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      $: (sel) => el(String(sel).replace(/^#/, '')),
+      toast: () => {},
+      errMessage: (d) => (d && d.error && d.error.message) || '',
+    },
+    OTBKit: kit,
+    scrollTo: () => {},
+  };
+  const document = { addEventListener: (t, h) => handlers.push({ t, h }) };
+  const sandbox = { window, document, console, setTimeout, clearTimeout, Date, encodeURIComponent };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(JS, sandbox, { filename: 'studio.js' });
+  const settle = async (n = 8) => { for (let i = 0; i < n; i++) await new Promise((r) => setImmediate(r)); };
+  // The boot IIFE awaits /me, then the two queue reads, then paint() fires the
+  // lazy reviewed-task read which repaints.
+  await settle();
+  // Fire the page's OWN delegated click handler with the element it looks for,
+  // so the verdict flows are exercised rather than read. `say` fills the words
+  // field first, exactly as a person would.
+  const fire = async (attr, value, { say = null } = {}) => {
+    if (say !== null) el('studio-words').value = say;
+    const node = { dataset: { [attr]: value } };
+    const ev = { target: { closest: (sel) => (sel === `[data-${attr}]` ? node : null) } };
+    for (const { t, h } of handlers) if (t === 'click') h(ev);
+    await settle();
+  };
+  return {
+    focus: () => el('studio-focus').innerHTML,
+    err: () => ({ text: el('studio-verdict-err').textContent, hidden: el('studio-verdict-err').hidden }),
+    field: () => el('studio-words').value,
+    writes: () => calls.filter((c) => c.method !== 'GET'),
+    calls,
+    verdict: (kind, opts) => fire('verdict', kind, opts),
+    skip: () => fire('skip', ''),
+    settle,
+  };
+}
+
+const REVIEW = {
+  id: '1900',
+  title: 'Artist review: the copy and visuals that shipped in task 1899',
+  description: 'STEP 1 — coach the grader.',
+  status: 'backlog',
+  source: 'cascade',
+  source_ref: 'cascade-artist-review-on-ship-1899',
+  goal_id: '1000074',
+  version_id: 'BONGOS-V2',
+  created_at: '2026-09-04T12:30:00.000Z',
+};
+const VISUAL_URL = '/api/bongos/task-visuals/task-1899-0011223344556677.png';
+
+test('a review WITH a visual shows the picture, and folds the steps behind the door', async () => {
+  const { focus, calls } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'The new hero, dark mode', security_sensitive: false } },
+  });
+  const html = focus();
+  assert.match(html, /class="studio-plate"/, 'the plate is drawn');
+  assert.match(html, /src="\/api\/bongos\/task-visuals\/task-1899-0011223344556677\.png"/, 'from the reviewed task\'s own visual');
+  assert.match(html, /studio-plate__caption">The new hero, dark mode/, 'with visual_alt as the caption');
+  // With a picture on it the card is the picture, one line of framing, and the
+  // verdict — the steps describe what happens after the door, not before it.
+  assert.ok(!/studio-steps/.test(html), 'the two steps are not between the artist and their answer');
+  assert.match(html, /Say what you see/, 'one short line of framing instead');
+  assert.match(html, /data-verdict="good"/, 'and the three weights are there');
+  // ONE extra read for the card in focus, not one per queued review.
+  const reads = calls.filter((c) => /\/tasks\/\d+$/.test(c.url));
+  assert.equal(reads.length, 1, `one reviewed-task read; made ${reads.length}`);
+});
+
+test('a review with NO visual degrades to the copy it always showed', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: null, security_sensitive: false } },
+  });
+  const html = focus();
+  assert.ok(!/studio-plate/.test(html), 'no empty frame');
+  assert.ok(!/<img/.test(html), 'and no image at all');
+  assert.match(html, /studio-steps/, 'both craft steps are back');
+  assert.match(html, /coaches the grader on how it judged the work/, 'as is the full framing paragraph');
+  assert.match(html, /data-verdict="good"/, 'the verdict is still offered — this is still a review');
+});
+
+test('a security_sensitive reviewed task shows no picture, and still reads as a review', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'the exploit', security_sensitive: true } },
+  });
+  const html = focus();
+  assert.ok(!/task-visuals/.test(html), 'the URL never reaches the page');
+  assert.ok(!/the exploit/.test(html), 'nor does the alt text');
+  assert.match(html, /studio-steps/, 'it degrades to the copy, exactly like a review with no visual');
+});
+
+test('a reviewed task that cannot be read leaves a working review card', async () => {
+  // A 404/403 on the reviewed task (it was merged, or the viewer cannot see it)
+  // must cost the artist nothing: the card is the one it always was.
+  const { focus } = await bootStudio({ reviews: [REVIEW], shipped: {} });
+  const html = focus();
+  assert.ok(!/studio-plate/.test(html));
+  assert.match(html, /studio-steps/);
+  assert.match(html, /The copy and visuals that shipped in task #1899/);
+});
+
+test('below the routes\' floor the card offers a sentence, not three refusals', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'a', security_sensitive: false } },
+    rank: 'xenos',
+  });
+  const html = focus();
+  assert.ok(!/data-verdict=/.test(html), 'no weight is drawn');
+  assert.match(html, /studio-verdict__sealed/, 'the sentence is');
+  assert.match(html, /open it to dismiss it, note what you saw, or file the follow-up/);
+  // The picture is NOT rank-gated — looking is every craft's business.
+  assert.match(html, /studio-plate/, 'and the artist can still see the work');
+});
+
+// ---------------------------------------------------------------------------
+// The verdict flows, FIRED rather than read. The static assertions above pin
+// the wiring and the allowlist; these click the page's own delegated handler
+// and inspect what it actually sent and what state it left behind — the splice
+// math in retire(), the double-submit guard, and the exact request bodies.
+// ---------------------------------------------------------------------------
+const SHIPPED_WITH_VISUAL = { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'The new hero', security_sensitive: false } };
+const three = () => [
+  { ...REVIEW, id: '1900', source_ref: 'cascade-artist-review-on-ship-1899' },
+  { ...REVIEW, id: '1901', source_ref: 'cascade-artist-review-on-ship-1898', created_at: '2026-09-03T00:00:00.000Z' },
+  { ...REVIEW, id: '1902', source_ref: 'cascade-artist-review-on-ship-1897', created_at: '2026-09-02T00:00:00.000Z' },
+];
+
+test('FIRE looks good: one abandon, carrying who said so, and the stone is gone', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  assert.match(s.focus(), /1 of 3/);
+  await s.verdict('good', { say: 'The hero lands.' });
+  const w = s.writes();
+  assert.equal(w.length, 1, `exactly one write; got ${JSON.stringify(w.map((c) => c.method + ' ' + c.url))}`);
+  assert.match(w[0].url, /\/tasks\/1900\/abandon$/, 'the REVIEW is abandoned, not the reviewed task');
+  assert.match(w[0].body.reason, /Reviewed in the studio by Artist A/, 'the reason names who judged it');
+  assert.match(w[0].body.reason, /The hero lands\./, 'and carries the optional words');
+  // retire() dropped it and the count re-read: 3 → 2, and the NEXT review is in
+  // focus rather than the list renumbering around a hole.
+  assert.match(s.focus(), /1 of 2/, 'the garden shrank and did not skip');
+  assert.match(s.focus(), /task #1898/, 'the next stone is the one that was behind it');
+});
+
+test('FIRE looks good with no words: still one abandon, no empty-words refusal', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('good');
+  assert.equal(s.writes().length, 1, '"looks good" is the one weight that needs no words');
+  assert.ok(!/undefined|null/.test(s.writes()[0].body.reason), 'and says nothing about absent words');
+});
+
+test('FIRE note it: the brief is re-read, appended, and the review STAYS in the garden', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('note', { say: 'The sub-line reads like a brochure.' });
+  const w = s.writes();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].method, 'PATCH');
+  assert.match(w[0].url, /\/tasks\/1900$/);
+  // The cascade's own brief survives, with the note after it — the failure mode
+  // here is a PATCH that REPLACES the body, so assert both halves are present.
+  assert.match(w[0].body.description, /^STEP 1 — coach the grader\./, 'the original brief is still the start of the field');
+  assert.match(w[0].body.description, /ARTIST NOTE \(\d{4}-\d{2}-\d{2}, Artist A, from the studio\)/, 'the note is stamped and attributed');
+  assert.match(w[0].body.description, /The sub-line reads like a brochure\.$/, 'and ends with what was written');
+  // A note is not a dismissal.
+  assert.match(s.focus(), /1 of 3/, 'the review is still waiting');
+  assert.equal(s.field(), '', 'the field is cleared for the next thought');
+  assert.equal(s.err().hidden, true);
+});
+
+test('FIRE note it with no words: nothing is sent at all', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('note', { say: '   ' });
+  assert.deepEqual(s.writes(), [], 'no write');
+  assert.deepEqual(s.calls.filter((c) => /\/tasks\/1900$/.test(c.url)), [], 'and not even the re-read');
+  assert.match(s.err().text, /Write what you saw first/);
+  assert.equal(s.err().hidden, false);
+});
+
+test('FIRE needs work: a task in the reviewed work\'s goal, then the review closed against it', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('work', { say: 'The plate is muddy at 320.' });
+  const w = s.writes();
+  assert.equal(w.length, 2, 'the pair: create, then merge');
+  const [create, merge] = w;
+  assert.match(create.url, /\/tasks$/);
+  assert.equal(create.body.goal_id, 1000074, 'the follow-up lands in the reviewed work\'s goal, as a number');
+  assert.equal(create.body.version_id, 'BONGOS-V2');
+  assert.equal(create.body.discipline, 'artist');
+  assert.equal(create.body.source_ref, 'studio-needs-work-on-review-1900', 'keyed so a double-click cannot file twice');
+  assert.match(create.body.description, /The plate is muddy at 320\./, 'the artist\'s words are the brief');
+  assert.match(create.body.description, /never edits a live string or asset/, 'and the brief says this is ordinary work');
+  assert.match(merge.url, /\/tasks\/1900\/merge$/, 'the REVIEW is the one closed');
+  assert.equal(merge.body.into_task_id, Number(NEW_TASK_ID), 'against the task just filed');
+  assert.match(s.focus(), /1 of 2/, 'and the review left the garden');
+});
+
+test('FIRE needs work when the merge fails: the filed task is NAMED, not lost', async () => {
+  // The half-done case is the one that matters: the follow-up exists, so the
+  // artist must be told its id rather than left thinking nothing happened.
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: ({ url }) => (/\/merge$/.test(url) ? { ok: false, data: { error: { code: 'x', message: 'no' } } } : null),
+  });
+  await s.verdict('work', { say: 'Muddy.' });
+  assert.equal(s.writes().length, 2, 'both halves were attempted');
+  assert.match(s.err().text, new RegExp(`Task ${NEW_TASK_ID} was filed`), 'the id is in the message');
+  assert.match(s.focus(), /1 of 3/, 'and the review stays put rather than vanishing unclosed');
+});
+
+test('FIRE a refused abandon: the review stays, and the server\'s own sentence is shown', async () => {
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: () => ({ ok: false, data: { error: { code: 'rank_forbidden', message: 'metic or above' } } }),
+  });
+  await s.verdict('good');
+  assert.equal(s.err().text, 'metic or above', 'the route\'s message, not a generic one');
+  assert.match(s.focus(), /1 of 3/, 'nothing was retired on a refusal');
+});
+
+test('FIRE two clicks: the second is swallowed, so a double-click files once', async () => {
+  // The busy flag, exercised: the write is held open, both clicks land, and only
+  // one request is made. Without the guard "needs work" files two tasks.
+  let release;
+  const held = new Promise((r) => { release = r; });
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: async () => { await held; return { ok: true, data: { ok: true } }; },
+  });
+  const first = s.verdict('good');
+  await s.verdict('good');
+  assert.equal(s.writes().length, 1, 'the second click did not start a second write');
+  release({ ok: true, data: { ok: true } });
+  await first;
+  await s.settle();
+  assert.equal(s.writes().length, 1);
+});
+
+test('FIRE below the floor: a forged click writes nothing', async () => {
+  // The weights are not drawn for a xenos — but the handler is delegated, so
+  // canVerdict() is re-checked in runVerdict rather than trusted to the render.
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL, rank: 'xenos' });
+  await s.verdict('good', { say: 'fine' });
+  await s.verdict('work', { say: 'not fine' });
+  assert.deepEqual(s.writes(), [], 'the room sends nothing it was not allowed to offer');
+});
+
+test('FIRE skip: it advances and writes nothing, and the last skip ends quietly', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.skip();
+  assert.match(s.focus(), /2 of 3/);
+  await s.skip();
+  await s.skip();
+  assert.deepEqual(s.writes(), [], 'skipping is not a verdict');
+  // Nothing was tended, so the emptied room reads as quiet, not as finished.
+  assert.match(s.focus(), /Nothing waits right now|tended everything/);
+});
+
 // Boot the real shell.js under a DOM stub (the hall_nav.mjs pattern) whose
 // #nav-studio records classList toggles, so applyCraftEmphasis is tested for
 // what it DOES, not just that it exists.

package/tests/rank_tier_single_source.mjs

@@ -163,7 +163,12 @@ const HALL_SCRIPTS = ['modules/hall-ui/public/builders.js', 'modules/hall-ui/pub
   // it needs both the tier order (its `rank` sort lens) and the known-rank test
   // (the badge variant class). Browser code cannot require db-kernel, so it takes
   // the pinned-copy shape builders.js already takes.
-  'modules/hall-ui/public/roster.js'];
+  'modules/hall-ui/public/roster.js',
+  // task 1003829: the Studio's verdict row offers four writes that all floor at
+  // METIC server-side, so the room reads the tier order to decide whether to draw
+  // them at all. Browser code cannot require db-kernel, so it takes the same
+  // pinned-copy shape builders.js and roster.js take.
+  'modules/hall-ui/public/studio.js'];
 // Filtered INSIDE the test, not at module scope: extractRankMaps is declared
 // further down, so calling it up here is a temporal-dead-zone crash.
 const staticMapFiles = () => HALL_SCRIPTS.filter(
@@ -198,6 +203,8 @@ const MAP_ALLOWLIST = new Set([
   'modules/hall-ui/public/goals-render.js',
   // task 1003441 — see the HALL_SCRIPTS note above: pinned, not unchecked.
   'modules/hall-ui/public/roster.js',
+  // task 1003829 — see the HALL_SCRIPTS note above: pinned, not unchecked.
+  'modules/hall-ui/public/studio.js',
 ]);
 // Where a rank-ladder array literal is allowed to exist.
 const LADDER_ALLOWLIST = new Set([

package/tests/task_visuals.mjs

@@ -193,6 +193,41 @@ await t('hall-kit: no visual renders nothing at all — never a placeholder', ()
   assert.ok(!html.includes('"before"'));
 });
 
+// ---- the full-size figure (task 1003829) -----------------------------------
+await t('hall-kit: the full-size figure is the same guard, at reading size', () => {
+  // Same no-placeholder rule as the thumbnail: nothing at all without a visual.
+  assert.equal(kit.taskVisualFigureHtml({ id: 1 }), '');
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
+  assert.equal(kit.taskVisualFigureHtml(null), '');
+  // And the same URL wall — an off-origin src or a javascript: payload is not
+  // "rendered without a caption", it is not rendered.
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
+
+  const url = '/api/gds/task-visuals/task-1-0011223344556677.png';
+  const html = kit.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
+  assert.ok(html.includes('<figure class="task-visual">'));
+  assert.ok(html.includes('class="task-visual__img"'));
+  // The caption is the SHIPPER's text — attacker-adjacent, so escaped in both
+  // the caption and the alt.
+  assert.ok(html.includes('<figcaption class="task-visual__caption">a &quot;before&quot; shot'));
+  assert.ok(!html.includes('"before"'));
+
+  // The caller owns the size, so it owns the class base; anything but
+  // [A-Za-z0-9_-] is stripped rather than interpolated into the attribute.
+  const studio = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
+  assert.ok(studio.includes('<figure class="studio-plate">'));
+  assert.ok(studio.includes('class="studio-plate__img"'));
+  const hostile = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
+  assert.ok(hostile.includes('<figure class="xonloada">'), hostile);
+
+  // No written alt → no caption at all. The fallback alt is a machine sentence
+  // for a screen reader, never a caption shown to a reader.
+  const bare = kit.taskVisualFigureHtml({ id: 7, visual_url: url });
+  assert.ok(!bare.includes('figcaption'));
+  assert.ok(bare.includes('alt="Visual for task 7"'));
+});
+
 // ---- cleanup ---------------------------------------------------------------
 await fs.rm(TMP, { recursive: true, force: true });