@bongos/core 1.19.695 → 1.19.697

package/tests/auth_resolve_failure.mjs

@@ -92,19 +92,20 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // The enumeration, kept as an executable assertion rather than prose so it cannot
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
-  //   requireBuilderPage         \
-  //   requireGovernmentPage       \
-  //   requireGovernmentManagePage  \ all SIX delegate to runPageGate, guarded by BV1.R107.
-  //   requireNonXenosPage          /  (the R113 roles-tab gate; the /people curate
-  //   requireProjectCuratePage    /    gate; the ADR 0266 /board-room vote gate)
-  //   requireBoardVotePage       /
+  //   requireBuilderPage        \
+  //   requireGovernmentPage      \ all FOUR delegate to runPageGate, guarded by
+  //   requireProjectCuratePage   /  BV1.R107 (the /people curate gate; the
+  //   requireBoardVotePage      /   ADR 0266 /board-room vote gate)
+  // Task 1003450 removed two more — requireNonXenosPage and the R113
+  // requireGovernmentManagePage — which had both ended up dispatched from no
+  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs.
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/government_page_gates.mjs

@@ -50,14 +50,19 @@ const resolver = require('../modules/government/resolver.js');
 const wandering = require('../modules/builder-settings/wandering-prefs.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
-const GATES = ['requireBuilderPage', 'requireNonXenosPage', 'requireGovernmentPage'];
+const GATES = ['requireBuilderPage', 'requireGovernmentPage'];
 const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 
 // ═══ the ORACLE — hand-written, from the rank tests R107 deleted ═════════════
 // requireBuilderPage    admitted any session at all     → every live rank
-// requireNonXenosPage   admitted rank !== 'xenos'       → thetes and up
 // requireGovernmentPage admitted rank === 'archon'      → archon only …until ADR 0157
 //
+// R107 migrated a THIRD gate, requireNonXenosPage (rank !== 'xenos' → thetes and
+// up, via page.view.builder). Task 1002710 emptied it of routes and task 1003450
+// deleted it; its rows are gone from the tables below rather than kept as an
+// oracle for a function that no longer exists. The parity claim it carried is
+// unaffected — it held right up to the deletion.
+//
 // ADR 0157 (owner decision, 2026-08-05) lowered `page.view.government` archon→metic, so
 // the monitoring pages (/watch, /harbor, /gate) now open to the working rank. That gate
 // was spelled `requireArchonPage` through R107 and ADR 0157 — the name the rows below
@@ -70,7 +75,6 @@ const LIVE_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
 // the gate matches its declared floor rather than merely "didn't change".
 const PRE_R107_AUDIENCE = {
   requireBuilderPage: { xenos: true, thetes: true, metic: true, archon: true },
-  requireNonXenosPage: { xenos: false, thetes: true, metic: true, archon: true },
   requireGovernmentPage: { xenos: false, thetes: false, metic: true, archon: true },
 };
 // Where a SIGNED-IN builder who fails the gate is sent. Never the sign-in flow —
@@ -80,12 +84,10 @@ const PRE_R107_AUDIENCE = {
 // instead of silently dumping the builder at the home page.
 const DENIED_TO = {
   requireBuilderPage: '/builders',
-  requireNonXenosPage: '/builders/not-ready',
   requireGovernmentPage: '/builders',
 };
 const GATE_PERMISSION = {
   requireBuilderPage: 'page.view.public',
-  requireNonXenosPage: 'page.view.builder',
   requireGovernmentPage: 'page.view.government',
 };
 const deniedLoc = (gate, { unavailable = false } = {}) =>
@@ -93,7 +95,6 @@ const deniedLoc = (gate, { unavailable = false } = {}) =>
 // The equivalent rank floor, for the independent cross-check below.
 const GATE_FLOOR = {
   requireBuilderPage: 'xenos',
-  requireNonXenosPage: 'thetes',
   // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernmentPage: 'metic',
 };
@@ -264,9 +265,14 @@ test('B4: the page gates resolve per request — no memoised authority (ADR 0016
 test('B5: every permission a page gate names is a real catalog key', async () => {
   // Not an oracle — a sanity check that the gates did not migrate onto a typo,
   // which would silently deny everyone (fail-closed, but a bug all the same).
-  for (const key of ['page.view.public', 'page.view.builder', 'page.view.government']) {
+  for (const key of ['page.view.public', 'page.view.government']) {
     assert.ok(catalog.byKey(key), `${key} must exist in the catalog`);
   }
+  // page.view.builder is deliberately NOT in that list any more: task 1003450
+  // deleted the only gate that named it. The atom is still seeded and attachable
+  // (catalog.js says so), so it is still a real key — it just is not a page
+  // gate's permission, and asserting it here would imply otherwise.
+  assert.ok(catalog.byKey('page.view.builder'), 'the atom survives its gate');
 });
 
 // ═══ PART C — the wandering CEILING (role metadata, not a permission) ════════

package/tests/hall_page_gate_map.mjs

@@ -34,11 +34,13 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 //
 // Audiences (the floors live in modules/government/catalog.js; the gate
 // functions in src/bongos/auth.js):
-//   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
+//   requireBuilderPage          page.view.public      any signed-in builder (xenos+)
 //   requireGovernmentPage       page.view.government  metic+   (ADR 0157)
 //   requireProjectCuratePage    project.curate        metic+
-//   requireGovernmentManagePage government.manage     archon
 //   requireBoardVotePage        board.vote.cast       xenos+   (ADR 0266)
+// That list is now CHECKED, not just written: "every page gate is dispatched"
+// below reads the gate table out of auth.js and fails if a gate here guards no
+// URL. Task 1003450 added it after finding two that did not.
 const ORACLE = {
   // Any signed-in builder — no rank floor.
   '/builders/work': 'requireBuilderPage',
@@ -60,10 +62,11 @@ const ORACLE = {
   '/builders/studio': 'requireBuilderPage',
   '/builders/ideas': 'requireBuilderPage',
   '/builders/collab': 'requireBuilderPage',
-  // task 1002710: the orientation reading rooms moved DOWN to this tier from
-  // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
-  // them above xenos turned away the exact reader they were written for. The
-  // sign-in requirement is unchanged — only the RANK floor is gone.
+  // task 1002710: the orientation reading rooms moved DOWN to this tier from a
+  // thetes+ gate. They are the onboarding documents, so gating them above xenos
+  // turned away the exact reader they were written for. The sign-in requirement
+  // is unchanged — only the RANK floor is gone. (Task 1003450 then deleted the
+  // gate those two rows left behind; see GONE_GATES below.)
   '/builders/primer': 'requireBuilderPage',
   '/builders/primer.md': 'requireBuilderPage',
   '/builders/diagrams': 'requireBuilderPage',
@@ -118,7 +121,6 @@ const ORACLE = {
   '/builders/ranks': null,
   '/builders/drachmae': null,
   '/builders/profile': null,
-  '/builders/not-ready': null,
 
   // NOT deliberate — recorded because it is true, and filed as idea 1000907
   // (task 1003448). The detail pages are addressed by a second segment, and
@@ -137,6 +139,15 @@ const ORACLE = {
   // from the map" is indistinguishable from the oversight this file exists to
   // catch. GONE_PAGES below keeps the row honest if the file ever returns.
   '/builders/my-projects': null,
+
+  // Gone too, and for a reason worth keeping in front of the next reader: this
+  // was a bespoke refusal PAGE ("not yet — ship three tasks to graduate"), the
+  // deniedTo of the thetes+ gate. Task 1002613 replaced that whole idea with a
+  // banner the shell renders from ?denied=<permission> on whatever page the
+  // redirect lands on — which names the permission actually missing instead of
+  // assuming one tier's remedy. Once task 1002710 emptied the gate, nothing
+  // linked here or redirected here; task 1003450 removed page and gate together.
+  '/builders/not-ready': null,
 };
 
 // ─── reconstruct the URL→gate map from the source ───────────────────────────
@@ -250,6 +261,8 @@ const GONE_PAGES = {
   // redirect. tests/hall_settings_world.mjs pins the deletion itself; this row
   // pins what the deletion means for the gate map.
   '/builders/my-projects': 'task 1003308 — the hub owns "my projects"',
+  // Task 1003450 — the shell's ?denied= banner replaced the bespoke refusal page.
+  '/builders/not-ready': 'task 1003450 — the shell renders the refusal from ?denied=',
 };
 
 test('a row that is null because the page left the hall serves no page', () => {
@@ -261,12 +274,72 @@ test('a row that is null because the page left the hall serves no page', () => {
   }
 });
 
-test('no gated page is left matching only a REMOVED gate function', () => {
-  // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
-  // catalog atom an Archon can attach to a custom role) but task 1002710 left it
-  // guarding nothing. If someone re-points a URL at it, that is a deliberate act
-  // that should update this oracle — not something to happen silently.
+// ─── the gate table itself: nothing exported that guards nothing ────────────
+//
+// The previous version of this block asserted, by name, that ONE gate
+// (requireNonXenosPage) guarded no URL — recording the dead code instead of
+// removing it. That reads as coverage and is the opposite: it pinned the defect
+// in place, and it could not see requireGovernmentManagePage, which had gone the
+// same way when R16 widened /government's shell to the metic floor. Both gates
+// are gone (task 1003450). What replaces the row is the general rule, which
+// fails on the NEXT one without anybody having to think of its name.
+//
+// Why it matters beyond tidiness: an exported gate with no route is a loaded
+// gun. It still resolves a permission and still redirects, so wiring it is one
+// line — and the reviewer of that line sees a function that looks maintained.
+// requireNonXenosPage would have re-imposed a rank floor the owner had
+// deliberately removed (task 1002710), and its deniedTo pointed at a page that
+// by then said the wrong thing.
+const AUTH_SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/auth.js'), 'utf8');
+
+// The keys of the PAGE_GATES table, read statically — the same posture as the
+// dispatch parse above (importing auth.js pulls the whole app in).
+function readPageGateNames(src) {
+  const table = /const PAGE_GATES = Object\.freeze\(\{([\s\S]*?)\n\}\);/.exec(src);
+  assert.ok(table, 'PAGE_GATES is still a `const PAGE_GATES = Object.freeze({…});` literal');
+  // Entry keys sit at exactly one indent level; `permission:` / `deniedTo:` /
+  // `alsoAdmits:` are nested deeper, so the two-space anchor keeps them out.
+  return [...table[1].matchAll(/^ {2}(require\w+):/gm)].map((m) => m[1]);
+}
+
+test('every page gate in the table is dispatched by at least one hall URL', () => {
+  const declared = readPageGateNames(AUTH_SRC);
+  assert.ok(declared.length >= 4, 'the gate table was found — an empty parse must not pass silently');
   const wired = new Set(DISPATCH.map((d) => d.gate));
-  assert.ok(!wired.has('requireNonXenosPage'),
-    'requireNonXenosPage guards no hall URL since task 1002710 — update the ORACLE if that changes');
+  for (const gate of declared) {
+    assert.ok(wired.has(gate),
+      `${gate} is declared in PAGE_GATES and dispatched from no route. Either wire it to a URL `
+      + '(and add that URL to the ORACLE above), or delete the gate — an exported gate that '
+      + 'guards nothing is a rank floor waiting to be re-imposed by accident.');
+  }
+});
+
+test('every gate a URL dispatches is declared in the gate table', () => {
+  // The other direction: gdsAuth.<name> in serve-internal.js is resolved at
+  // runtime, so a typo or a rename is an undefined-is-not-a-function on the
+  // first request to that page rather than a boot failure.
+  const declared = new Set(readPageGateNames(AUTH_SRC));
+  for (const { gate } of DISPATCH) {
+    assert.ok(declared.has(gate), `serve-internal.js dispatches gdsAuth.${gate}, which PAGE_GATES does not declare`);
+  }
+});
+
+test("every gate's deniedTo is a hall page that is actually served", () => {
+  // The failure this catches is the one task 1003450 cleaned up, in its most
+  // dangerous form: deleting a page that a live gate still redirects to. The
+  // refused visitor would land on a 404 with no way back and no explanation —
+  // strictly worse than the 403 the redirect exists to avoid.
+  const dests = [...AUTH_SRC.matchAll(/deniedTo:\s*'([^']+)'/g)].map((m) => m[1]);
+  assert.ok(dests.length, 'the deniedTo destinations were found');
+  for (const dest of dests) {
+    assert.ok(dest.startsWith('/builders'), `${dest} must be a hall URL`);
+    const slug = dest.replace(/^\/builders\/?/, '');
+    // The oracle spells the hall index with its trailing slash; every other row
+    // is written without one.
+    assert.equal(ORACLE[slug ? dest : '/builders/'], null,
+      `${dest} is a deniedTo, so it must be UNGATED — redirecting a refused visitor at a gated page loops`);
+    if (!slug) continue; // /builders itself is the hall index, served from index.html
+    assert.ok(fs.existsSync(path.join(HALL_PAGES_DIR, `${slug}.html`)),
+      `${dest} is a deniedTo destination but no page is served there — a refused visitor gets a 404`);
+  }
 });

package/tests/hall_settings_world.mjs

@@ -1,5 +1,5 @@
 // tests/hall_settings_world.mjs — the PANEL family in the chrome world
-// (task 1003308, goal 1000081): settings, profile, pair, not-ready.
+// (task 1003308, goal 1000081): settings, profile, pair.
 //
 // tests/hall_tokens.mjs pins the TIER these pages spend; this pins how they
 // spend it. Everything here is a fact that is silent in a browser: the page
@@ -33,7 +33,7 @@
 //   node scripts/hall-preview/server.js --port 4621 --fixture-me
 //   node modules/ui-design/kit/render.js --states modules/hall-ui/public/settings.states.json \
 //     --base-in http://builders.localhost:4621 --base-out http://builders.localhost:4621
-//   (and profile / pair / not-ready .states.json the same way)
+//   (and profile / pair .states.json the same way)
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
@@ -46,7 +46,10 @@ const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const stripComments = (css) => css.replace(/\/\*[\s\S]*?\*\//g, '');
 
-const PAGES = ['settings', 'profile', 'pair', 'not-ready'];
+// not-ready was the fourth until task 1003450 deleted the page — see
+// tests/hall_page_gate_map.mjs (GONE_PAGES) for why, and for the row that stops
+// it coming back ungated. The archetype is unaffected: three pages still spend it.
+const PAGES = ['settings', 'profile', 'pair'];
 const SHEETS = ['panel.css', 'settings.css', 'pair.css', 'profile.css'];
 
 const panelCss = read('panel.css');

package/tests/scouting_page_gate.mjs

@@ -166,9 +166,12 @@ await t('the OTHER page gates are untouched — their seam is never consulted at
     'and its denial is unchanged, down to the permission it names');
   const { nexted: pub } = await runGate('requireBuilderPage', OWNER, spy);
   assert.ok(pub, 'the public hall page still admits every signed-in builder, exactly as before');
-  const { res: nx } = await runGate('requireNonXenosPage', OWNER, spy);
-  assert.deepEqual(nx._redirect, { code: 302, loc: '/builders/not-ready?denied=page.view.builder' },
-    'and the orientation rooms still send a xenos to the friendly notice');
+  // A third gate stood here — requireNonXenosPage, refusing a xenos to
+  // /builders/not-ready. Task 1003450 deleted it and that page together; the two
+  // above carry the same claim (a gate declaring no alsoAdmits never touches the
+  // seam), and the board-room gate below is the wider third case.
+  const { nexted: vote } = await runGate('requireBoardVotePage', OWNER, spy);
+  assert.ok(vote, 'board.vote.cast floors at xenos on purpose (ADR 0266) — admitted without the seam');
 });
 
 await t('only ONE gate declares a second door (a widening must be opted into, one gate at a time)', () => {

package/tests/secret_box.mjs

@@ -6,16 +6,20 @@
 // tamper detection (a flipped byte fails the auth tag), wrong-key failure, and
 // the fail-closed isConfigured() behaviour.
 //
-// Hermetic: forces BUILDER_SECRET_KEY + HOME so the ~/.config/otb/builder-secret.key
-// fallback can't resolve to a real operator file on the test machine.
+// Hermetic: forces BUILDER_SECRET_KEY and redirects the HOME DIRECTORY — every
+// variable a platform might read for it, not HOME alone — so the
+// ~/.config/<instance>/builder-secret.key fallback cannot resolve to a real
+// operator file on the test machine. withKey then PROVES the redirect landed
+// (os.homedir() must be inside the sandbox) before running any body, and refuses
+// loudly if it did not. HOME alone was a no-op on Windows; see withKey (task 1001435).
 //
 // Run:  node tests/secret_box.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { mkdtempSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import os, { tmpdir } from 'node:os';
+import path, { join } from 'node:path';
 import crypto from 'node:crypto';
 
 const require = createRequire(import.meta.url);
@@ -38,18 +42,69 @@ function t(name, fn) {
 const KEY_HEX = crypto.randomBytes(32).toString('hex');
 const OTHER_HEX = crypto.randomBytes(32).toString('hex');
 
-// Run a thunk with BUILDER_SECRET_KEY + an empty HOME, restoring both after.
+// Run a thunk with BUILDER_SECRET_KEY + an empty home, restoring everything after.
+//
+// SETTING HOME ALONE IS NOT ISOLATION (task 1001435, applying task 1003760's
+// contract). This file's header promises the real ~/.config/<instance>/
+// builder-secret.key "is never touched", and secret-box.js finds that file via
+// instance-config configHome() -> os.homedir(). On Windows os.homedir() reads
+// USERPROFILE and NEVER consults HOME, so the override below isolated nothing
+// there: the promise held on POSIX and was silently false on every Windows
+// checkout. Exactly the miss that cost real credentials in task 1003760, which
+// found ten files using this pattern and left the stragglers as task 1003763.
+//
+// No key file was in fact being written to the real config dir — measured before
+// changing this, by running the suite and checking the path — because every
+// provisioning case passes an explicit `file`. So this closes a LATENT hole, not
+// an active leak. It is still worth closing: the next case added here would
+// reasonably trust the header's promise, and the failure mode is destroying a
+// builder's own master key.
+// `home` is always an mkdtempSync(os.tmpdir()) path we just created, so the
+// HOMEDRIVE/HOMEPATH split below is plain string work on a value of our own making
+// — never attacker-influenced. If this shape is ever reused on an untrusted path,
+// split with path.win32 helpers instead of slicing.
+function sandboxHomeEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    HOME: home,
+    USERPROFILE: home,                          // Windows: what os.homedir() actually reads
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),     // legacy Windows fallback pair
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
 function withKey(keyValue, fn) {
   const origKey = process.env.BUILDER_SECRET_KEY;
-  const origHome = process.env.HOME;
   if (keyValue === null) delete process.env.BUILDER_SECRET_KEY;
   else process.env.BUILDER_SECRET_KEY = keyValue;
-  process.env.HOME = mkdtempSync(join(tmpdir(), 'otb-secretbox-'));
-  try { fn(); }
+
+  const home = mkdtempSync(join(tmpdir(), 'otb-secretbox-'));
+  const sandbox = sandboxHomeEnv(home);
+  const orig = {};
+  for (const k of Object.keys(sandbox)) orig[k] = process.env[k];
+  Object.assign(process.env, sandbox);
+  try {
+    // Layer 2 of the same contract: PROVE the override landed before running a
+    // body that can write a master key. os.homedir() re-reads the environment on
+    // every call (measured on win32: it follows USERPROFILE mid-process), so this
+    // is a real check, not a tautology. A future platform that reads some third
+    // variable fails here LOUDLY instead of quietly writing to the real config dir
+    // — the only acceptable outcome for a test whose subject is a secret file.
+    if (os.homedir() !== home) {
+      throw new Error(
+        `secret_box sandbox escape: os.homedir() is ${os.homedir()} but the sandbox is ${home} — `
+        + 'refusing to run, this would touch the real builder-secret.key.'
+      );
+    }
+    fn();
+  }
   finally {
     if (origKey === undefined) delete process.env.BUILDER_SECRET_KEY;
     else process.env.BUILDER_SECRET_KEY = origKey;
-    process.env.HOME = origHome;
+    for (const [k, v] of Object.entries(orig)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
   }
 }
 
@@ -146,6 +201,25 @@ t('decrypt rejects a malformed blob', () => {
   });
 });
 
+// task 1001435: the isolation this file's header PROMISES, asserted instead of
+// assumed. Before this, withKey set HOME only — which on Windows os.homedir()
+// never reads — so the promise that the real builder-secret.key "is never
+// touched" was true on POSIX and false here, and nothing would have said so.
+t('withKey actually isolates the home dir — the header\'s promise, checked', () => {
+  const realHome = os.homedir();
+  let insideHome = null;
+  let insideConfig = null;
+  withKey(KEY_HEX, () => {
+    insideHome = os.homedir();
+    // The path secret-box.js would resolve for the key file, via the same
+    // instance-config chain it uses at runtime.
+    insideConfig = join(os.homedir(), '.config');
+  });
+  assert.notEqual(insideHome, realHome, 'the body must not see the builder\'s real home');
+  assert.ok(insideConfig.startsWith(insideHome), 'and the config dir must sit inside the sandbox');
+  assert.equal(os.homedir(), realHome, 'and the real home is restored afterwards');
+});
+
 console.log('\nprovisionMasterKey (task 1398 — productized, idempotent, never-overwrite):');
 
 // Split in two (task 1003529): the creation claim holds on every platform, the MODE

package/tests/unit_runner_serial.mjs

@@ -0,0 +1,72 @@
+// tests/unit_runner_serial.mjs
+//
+// The `unit` gate runs its tests SERIALLY, one child process each — pinned here
+// because that property is now load-bearing, not incidental (task 1001435).
+//
+// A flaky-`unit` report (idea #353) diagnosed "parallel execution racing on shared
+// global state" and asked, correctly, whether run-unit-tests fans tests out
+// concurrently in one process. It does not: runOne calls execFileSync, which
+// BLOCKS, from plain sequential for-loops. That rules an in-process race out by
+// construction, and scripts/gds/run-unit-tests.js now records the audit that
+// followed from it — including that two of the three suites the report named
+// (fitness, session_index) mutate no global state at all.
+//
+// All of that reasoning is only true while execution stays serial. Make the runner
+// concurrent and every word of it silently becomes wrong, with no test to say so —
+// so this suite fails if that happens, and whoever does it has to revisit the note
+// rather than leave a stale explanation behind.
+//
+// Static source assertions on purpose: actually observing concurrency would mean
+// running the whole gate from inside the gate.
+//
+// Run:  node tests/unit_runner_serial.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const RUNNER = path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js');
+const src = fs.readFileSync(RUNNER, 'utf8');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('each test runs in its OWN process, spawned synchronously', () => {
+  assert.match(src, /execFileSync\(\s*process\.execPath/,
+    'the runner must spawn each test with execFileSync (blocking, one process per test)');
+});
+
+t('the run loops are sequential — no concurrency primitive in the runner', () => {
+  // Promise.all / allSettled over the file list, a worker pool, or the async
+  // execFile would each make the suites overlap and reintroduce the shared-state
+  // class the recorded audit rules out.
+  assert.doesNotMatch(src, /Promise\.(all|allSettled|race)\s*\(/,
+    'a Promise.all over the test list would run suites concurrently');
+  assert.doesNotMatch(src, /require\(['"]node:worker_threads['"]\)|from ['"]node:worker_threads['"]/,
+    'a worker pool would run suites concurrently');
+  assert.doesNotMatch(src, /\bexecFile\s*\(/,
+    'the ASYNC execFile would overlap suites; the runner uses execFileSync');
+});
+
+t('the loop over the discovered test files is a plain for-of', () => {
+  assert.match(src, /for \(const name of files\) runOne\(/,
+    'sequential iteration is the mechanism — not a map() returning promises');
+});
+
+t('the serial guarantee is EXPLAINED where it is relied on, not just true by accident', () => {
+  // The audit recorded beside the loop is what a future flake investigation reads
+  // instead of re-deriving it. If the loop is rewritten the note must be revisited,
+  // which is the whole point of pinning it next to the mechanism.
+  assert.match(src, /EXECUTION IS SERIAL, ONE PROCESS PER TEST/,
+    'run-unit-tests.js must carry the note explaining why serialism is relied upon');
+});
+
+console.log('');
+console.log(`unit_runner_serial: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/modules/hall-ui/public/not-ready.html

@@ -1,53 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Not yet available — {{worldName}}</title>
-  <meta name="description" content="This page unlocks as you advance. Ship your first three tasks to open the rest of the builder hub.">
-  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <!-- The PANEL archetype (task 1003308): this page is its sign-in gate shape. -->
-  <link rel="stylesheet" href="/builders/panel.css">
-</head>
-<body data-page="not-ready" data-page-title="Locked">
-
-<div class="app">
-  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
-  <div class="app-scrim" id="app-scrim" hidden></div>
-  <div class="app-body">
-    <header class="app-topbar" id="app-topbar"></header>
-    <div class="app-content">
-      <!-- The page's ONE h1 (one-header-main-h1), in the family's voice. -->
-      <div class="page-head page-head--room page-head--panel">
-        <h1 id="not-ready-h1" class="page-head__h">not yet</h1>
-        <p class="page-head__sub">This page unlocks as you advance.</p>
-      </div>
-      <main id="hall-main">
-        <section class="scroll gate" aria-labelledby="not-ready-h">
-          <h2 id="not-ready-h" class="gate__h">Not yet available</h2>
-          <p class="gate__lede">
-            Xenos builders start with a focused set of pages — ship your first
-            <strong>three tasks</strong> to graduate and open the rest of
-            {{worldName}}'s builder hub.
-          </p>
-          <div class="row-end">
-            <a class="pbtn pbtn--save" href="/ranks">See how ranks work</a>
-            <a class="pbtn pbtn--quiet" href="/">Back to home</a>
-          </div>
-        </section>
-      </main>
-      <footer class="app-foot" id="app-foot"></footer>
-    </div>
-  </div>
-</div>
-
-<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
-
-<script src="/builders/shell.js"></script>
-<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
-<script src="/builders/palette.js" defer></script>
-</body>
-</html>

package/modules/hall-ui/public/not-ready.states.json

@@ -1,14 +0,0 @@
-{
-  "_": "The NOT-READY page through modules/ui-design/kit/render.js (task 1003308) — the sign-in gate shape of the panel family, static markup with no feed. Renders under the kit's own stub and under the harness alike.",
-  "page": "/not-ready",
-  "surface": "hall-ui",
-  "stub": { "prefix": "/builders/" },
-  "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
-  "states": {
-    "locked": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#not-ready-h1", "#not-ready-h"] } },
-    "out": { "auth": false, "actions": [["wait", 400]], "expect": { "visible": ["#not-ready-h1"] } }
-  },
-  "reducedMotion": { "auth": true, "actions": [["wait", 400]] }
-}