@bongos/core 1.19.762 → 1.19.764

package/scripts/gds/audit-ships.js

@@ -9,35 +9,92 @@
 // Audit-only — does NOT write to task_grades. Pre-grader ships keep clean
 // history.
 
-const { execSync } = require('node:child_process');
+const { execFileSync } = require('node:child_process');
 const grader = require('../../modules/grading/grader');
 const { cliClient } = require('./cli-lib');
 
+// EVERY git call here goes through argv, never a shell string (task 1003223 —
+// the class task 1002761 named and task 1002526 fixed in docs-entropy).
+//
+// WHAT WAS WRONG. Five call sites built shell strings. THREE of them interpolated
+// a quoted empty `--format=''`; a POSIX shell strips those quotes and git sees an
+// empty format, but the shell Node uses on Windows does not, so git receives
+// `--format=''` literally and dies with `fatal: invalid --pretty format: ''`.
+// Verified on win32 before fixing: the shell-string form throws, the argv form
+// returns " 1 file changed, 139 insertions(+)". The correct argv spelling is
+// `--format=` — empty value, no quotes, which no shell can mangle because no
+// shell is involved. The other two passed `--format='%H %s'`, which survives a
+// POSIX shell and arrives with literal quotes elsewhere; same class, same fix.
+//
+// WHY IT MATTERED MORE THAN A LOUD CRASH. The originating row asked whether the
+// try/catch around these calls "degrades to a silently empty audit — if so it is
+// the same dangerous shape after all". It did. Every catch returned null or [],
+// so on Windows the audit reported no diff stats and zero downstream impact for
+// EVERY ship, and looked like a clean run. `gitFails` below keeps the same return
+// values but says so on stderr, so an empty audit can never again be mistaken for
+// an uneventful one.
+//
+// One of the five also built a `grep | head | awk` pipeline and pinned
+// `shell: '/bin/bash'` to survive; that filtering is now done in JS, so the script
+// needs no shell at all.
+function gitLines(args, { cwd } = {}) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+// One place that reports a git failure instead of swallowing it. Returns the
+// caller's fallback so behaviour is unchanged; only the silence is.
+function gitFails(what, err, fallback) {
+  const msg = String((err && (err.stderr || err.message)) || err).trim().split('\n')[0];
+  console.error(`audit-ships: ${what} failed — ${msg}`);
+  return fallback;
+}
+
 const DAYS = Number(process.env.AUDIT_DAYS || 2);
 
+// `git log --all` once per RUN, not once per task.
+//
+// The shell pipeline this replaced ended in `head -1`, which let git stop as soon
+// as one subject matched. The argv rewrite has no such early exit — and
+// findCommitForTask is called once per shipped task, up to 500 in a run — so a
+// naive port turned one bounded call into 500 full history walks. The commit list
+// cannot change mid-run, so it is read once and reused. Caught by the grader on
+// the first round of this task, which is a fair catch: replacing a shell pipeline
+// means inheriting the work its operators were doing, not just its output.
+let commitSubjectsCache = null;
+function commitSubjects() {
+  if (commitSubjectsCache) return commitSubjectsCache;
+  commitSubjectsCache = gitLines(['log', '--all', '--format=%H %s']);
+  return commitSubjectsCache;
+}
+
 function findCommitForTask(taskId) {
-  let sha;
+  // Matches both subject conventions: the legacy ' #NNN:' prefix and the de-#-ed
+  // 'task NNN:' form ship.js writes since task 916 (a bare "#NNN" in commit
+  // subjects autolinked to dead GitHub issue numbers).
+  //
+  // The grep|head|awk pipeline this replaces needed `shell: '/bin/bash'` to run at
+  // all — a hard dependency on a POSIX shell at a fixed path, for filtering JS can
+  // do. Doing it here also makes the id match EXACT: the old regex was
+  // interpolated unescaped, so a task id was pasted straight into a regex.
+  const re = new RegExp(` (?:#|task )${String(taskId).replace(/[^0-9]/g, '')}:`);
+  let lines;
   try {
-    sha = execSync(
-      // Matches both subject conventions: the legacy ' #NNN:' prefix and the
-      // de-#-ed 'task NNN:' form ship.js writes since task 916 (a bare "#NNN"
-      // in commit subjects autolinked to dead GitHub issue numbers).
-      `git log --all --format='%H %s' | grep -E ' (#|task )${taskId}:' | head -1 | awk '{print $1}'`,
-      { encoding: 'utf8', shell: '/bin/bash' }
-    ).trim();
-  } catch (_) {
-    return null;
+    lines = commitSubjects();
+  } catch (e) {
+    return gitFails(`finding the commit for task ${taskId}`, e, null);
   }
-  return sha || null;
+  const hit = lines.find((l) => re.test(l));
+  return hit ? (hit.split(' ')[0] || null) : null;
 }
 
 function gitDiffStatsForCommit(sha) {
   if (!sha) return null;
   let raw;
   try {
-    raw = execSync(`git show --shortstat --format='' ${sha}`, { encoding: 'utf8' });
-  } catch (_) {
-    return null;
+    raw = execFileSync('git', ['show', '--shortstat', '--format=', sha], { encoding: 'utf8' });
+  } catch (e) {
+    return gitFails(`reading diff stats for ${String(sha).slice(0, 8)}`, e, null);
   }
   // Example shortstat line: " 15 files changed, 1171 insertions(+), 65 deletions(-)"
   const m = raw.match(/(\d+) files? changed(?:, (\d+) insertions?\(\+\))?(?:, (\d+) deletions?\(-\))?/);
@@ -53,10 +110,9 @@ function gitDiffStatsForCommit(sha) {
 function filesTouchedByCommit(sha) {
   if (!sha) return [];
   try {
-    const out = execSync(`git show --name-only --format='' ${sha}`, { encoding: 'utf8' });
-    return out.split('\n').map((s) => s.trim()).filter(Boolean);
-  } catch (_) {
-    return [];
+    return gitLines(['show', '--name-only', '--format=', sha]);
+  } catch (e) {
+    return gitFails(`listing files touched by ${String(sha).slice(0, 8)}`, e, []);
   }
 }
 
@@ -64,35 +120,30 @@ function filesTouchedByCommit(sha) {
 // from origin/main that landed AFTER `sha` and touched any of `files`. High
 // count = subsequent work has built on top of this change, so a "redo"
 // risks conflicts. Excludes `sha` itself.
+const NO_DOWNSTREAM = Object.freeze({
+  commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [],
+});
+
 function downstreamImpact(sha, files) {
-  if (!sha || files.length === 0) {
-    return { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] };
-  }
-  // -- shell-quote each file path so spaces/specials don't break the cmd.
-  const fileArgs = files.map((f) => `'${f.replace(/'/g, "'\\''")}'`).join(' ');
-  let out;
+  if (!sha || files.length === 0) return { ...NO_DOWNSTREAM };
+  // The hand-rolled POSIX shell-quoting this replaces ("'" + escape + "'") was
+  // both unnecessary and wrong on Windows, where that quoting style is not the
+  // shell's. In argv form a path with spaces, quotes or a `$` is just an element.
+  const range = `${sha}..origin/main`;
+  let lines;
   try {
-    out = execSync(
-      `git log ${sha}..origin/main --format='%H %s' -- ${fileArgs}`,
-      { encoding: 'utf8' }
-    );
-  } catch (_) {
-    return { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] };
+    lines = gitLines(['log', range, '--format=%H %s', '--', ...files]);
+  } catch (e) {
+    return gitFails(`reading downstream commits after ${String(sha).slice(0, 8)}`, e, { ...NO_DOWNSTREAM });
   }
-  const lines = out.split('\n').map((s) => s.trim()).filter(Boolean);
   // Distinct downstream files touched
   let distinct = 0;
   try {
-    const namesOut = execSync(
-      `git log ${sha}..origin/main --name-only --format='' -- ${fileArgs}`,
-      { encoding: 'utf8' }
-    );
-    const set = new Set(
-      namesOut.split('\n').map((s) => s.trim()).filter(Boolean)
-    );
-    distinct = set.size;
-  } catch (_) {
-    distinct = 0;
+    distinct = new Set(gitLines(['log', range, '--name-only', '--format=', '--', ...files])).size;
+  } catch (e) {
+    // Same shape as every other call site: the fallback comes FROM gitFails, so
+    // the value and the report can never drift apart.
+    distinct = gitFails(`reading downstream files after ${String(sha).slice(0, 8)}`, e, 0);
   }
   return {
     commits_after_touching_files: lines.length,
@@ -251,7 +302,18 @@ async function main() {
   for (const [k, v] of Object.entries(buckets)) console.log(`  ${k}: ${v}`);
 }
 
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});
+// Run only as a CLI. Without this guard the file executes main() — and hits the
+// API — the instant anything requires it, which is why its git helpers had never
+// been tested: there was no way to reach them without starting an audit
+// (task 1003223).
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}
+
+// Exported for tests/audit_ships_git_argv.mjs — the argv-vs-shell-string fix is a
+// property of THESE functions, so the test drives them rather than re-typing an
+// equivalent git call and hoping it matches.
+module.exports = { findCommitForTask, gitDiffStatsForCommit, filesTouchedByCommit, downstreamImpact };

package/scripts/hall-preview/live-identity.js

@@ -29,6 +29,7 @@ const ME_SCOPED_PATHS = [
   'me/profile-nudge',
   'me/render',
   'me/wandering',
+  'me/interaction',
   'me/skill-prefs',
   'me/sound-prefs',
   'me/event-sound-prefs',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.762'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.764'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/audit_ships_git_argv.mjs

@@ -0,0 +1,173 @@
+// tests/audit_ships_git_argv.mjs — audit-ships' git calls must be argv, not a
+// shell string (task 1003223; the class task 1002761 named).
+//
+// THE BUG. Five calls interpolated `--format=''` into a shell string. A POSIX
+// shell strips the quotes and git sees an empty format; the shell Node uses on
+// Windows does not, so git receives `--format=''` literally and dies with
+// `fatal: invalid --pretty format: ''`. A sixth built a `grep | head | awk`
+// pipeline and pinned `shell: '/bin/bash'` to survive at all.
+//
+// WHY THIS NEEDS A TEST AND NOT JUST A FIX. Every one of those calls sat inside a
+// try/catch that returned null or []. So the Windows failure did not crash the
+// audit — it produced an audit with no diff stats and zero downstream impact for
+// every ship, which is indistinguishable from a clean run. The originating row
+// asked exactly this ("check whether the catch degrades to a silently empty audit
+// — if so it is the same dangerous shape after all"). It did.
+//
+// The static half of this file is the real net: it is the half that stays true on
+// Linux CI, where the shell-string form would have passed happily forever.
+//
+// Run:  node --test tests/audit_ships_git_argv.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execSync, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const FILE = path.join(ROOT, 'scripts/gds/audit-ships.js');
+const audit = require('../scripts/gds/audit-ships.js');
+const raw = fs.readFileSync(FILE, 'utf8');
+
+// Scan CODE, not prose. The file's header explains the bug by quoting the exact
+// tokens that are banned ("--format=''", "grep -E", "shell: '/bin/bash'"), so a
+// naive scan of the whole file fails on its own documentation — which is exactly
+// what happened when this test was first written. Same comments-stripped posture
+// as scripts/gds/category-advisory-guard.js.
+const src = raw
+  .replace(/\/\*[\s\S]*?\*\//g, '')          // block comments
+  .split('\n').map((l) => l.replace(/(^|\s)\/\/.*$/, '$1')).join('\n');
+
+// ---- static: the shape that broke must not come back ----------------------
+
+test('no execSync anywhere — a shell string is what mangles the quoting', () => {
+  assert.doesNotMatch(src, /\bexecSync\b/,
+    'audit-ships must spawn git through execFileSync with an argv array');
+});
+
+test("no quoted --format='' — the argv spelling is --format= with no quotes", () => {
+  // Match the SHELL form precisely: two consecutive quotes after the '='. A naive
+  // /--format='/ also matches the correct argv literal '--format=', where that
+  // quote is JS string syntax, not a shell quote — it flagged the fix as the bug.
+  assert.doesNotMatch(src, /--format=''/,
+    "a quoted empty format is the exact token git rejects on Windows");
+  assert.match(src, /'--format='/, 'the argv spelling is present');
+});
+
+test('no shell pipeline and no pinned /bin/bash', () => {
+  assert.doesNotMatch(src, /\bshell:\s*['"]/, 'no shell is needed once calls are argv');
+  for (const tool of ['grep -E', '| head', '| awk']) {
+    assert.ok(!src.includes(tool), `${tool} is a POSIX-only dependency`);
+  }
+});
+
+test('git failures are reported, not swallowed into a clean-looking audit', () => {
+  // The silent `catch (_) { return null; }` is what made the Windows breakage
+  // invisible. Every catch around a git call must go through gitFails.
+  assert.match(raw, /function gitFails\(/, 'the reporting helper exists');
+  // Scoped to catches returning an empty RESULT SET — null or [] — which is the
+  // shape that turned a git failure into a clean-looking audit. A catch returning
+  // `{}` for an unreadable branding pack is a different, legitimate default and is
+  // deliberately not swept up here.
+  const silent = src.match(/catch \(_\)\s*\{\s*return (?:null|\[\])/g) || [];
+  assert.equal(silent.length, 0,
+    `silent catch(es) returning an empty result: ${silent.join(' | ')}`);
+});
+
+// ---- behavioural: the calls actually work on THIS platform ----------------
+//
+// These run real git against this repo, which is what makes them meaningful on
+// Windows: before the fix, two of them threw here and returned empty.
+
+const git = (args) => execFileSync('git', args, { cwd: ROOT, encoding: 'utf8' }).trim();
+// A NON-MERGE commit. `git show --name-only` prints nothing for a merge by
+// default, so anchoring on HEAD makes the file-listing assertions depend on
+// whatever happened to be checked out — they failed here for that reason, not
+// because the code was wrong. --no-merges picks a commit that really touched files.
+const HEAD = git(['rev-list', '--no-merges', '-n', '1', 'HEAD']);
+
+test('the exact argv git rejected as a shell string succeeds here', () => {
+  const out = execFileSync('git', ['show', '--shortstat', '--format=', HEAD], { cwd: ROOT, encoding: 'utf8' });
+  assert.match(out, /\d+ files? changed/, `shortstat should parse, got: ${JSON.stringify(out.slice(0, 80))}`);
+});
+
+test('the shell-string form is what actually fails on this platform', () => {
+  // Not a hypothetical: assert the OLD form's behaviour so the reason for the fix
+  // is recorded in a runnable way. On POSIX it succeeds (the quotes are stripped),
+  // on Windows it throws — either way, argv is the only spelling that is correct
+  // on both, which is the whole point.
+  let threw = false;
+  try { execSync(`git show --shortstat --format='' ${HEAD}`, { cwd: ROOT, encoding: 'utf8' }); }
+  catch { threw = true; }
+  if (process.platform === 'win32') {
+    assert.equal(threw, true, 'on win32 the quoted form must be the one that fails');
+  } else {
+    assert.equal(threw, false, 'on POSIX it happens to work — which is why this hid on CI');
+  }
+});
+
+test('--name-only --format= yields real paths', () => {
+  const out = execFileSync('git', ['show', '--name-only', '--format=', HEAD], { cwd: ROOT, encoding: 'utf8' });
+  const files = out.split('\n').map((s) => s.trim()).filter(Boolean);
+  assert.ok(files.length > 0, 'HEAD touched at least one file');
+  assert.ok(files.every((f) => !f.includes("'")), 'paths come back unquoted');
+});
+
+// ---- the real functions, not equivalents ---------------------------------
+//
+// These drive audit-ships' own helpers. Before this task the file executed main()
+// on require — it hit the API the moment anything imported it — so its git helpers
+// had never been reachable from a test at all. That is the deeper reason the
+// Windows breakage went unnoticed for months.
+
+test('gitDiffStatsForCommit returns real stats on this platform', () => {
+  const stats = audit.gitDiffStatsForCommit(HEAD);
+  assert.ok(stats, 'must not be the null the Windows failure returned');
+  assert.equal(stats.commit_sha, HEAD);
+  assert.ok(stats.files_changed > 0, `files_changed should be positive, got ${stats.files_changed}`);
+});
+
+test('filesTouchedByCommit returns real paths, not the empty array of a swallowed failure', () => {
+  const files = audit.filesTouchedByCommit(HEAD);
+  assert.ok(Array.isArray(files) && files.length > 0, `expected paths, got ${JSON.stringify(files)}`);
+  assert.ok(files.every((f) => typeof f === 'string' && f.length > 0));
+});
+
+test('the commit list is read once per run, not once per task', () => {
+  // The shell pipeline this replaced ended in `head -1`, so git stopped at the
+  // first match. The argv form has no early exit, and findCommitForTask runs once
+  // per shipped task — up to 500 a run — so a naive port turns one bounded call
+  // into 500 full history walks. Caught by the grader on this task's first round.
+  //
+  // Measured rather than asserted structurally: the second lookup must not spend
+  // anywhere near the first's time, because it must not touch git at all.
+  const t0 = process.hrtime.bigint();
+  audit.findCommitForTask(999999901);
+  const cold = process.hrtime.bigint() - t0;
+
+  const t1 = process.hrtime.bigint();
+  audit.findCommitForTask(999999902);
+  const warm = process.hrtime.bigint() - t1;
+
+  assert.ok(warm * 5n < cold || warm < 2_000_000n,
+    `second lookup should reuse the cached list (cold ${cold / 1000000n}ms, warm ${warm / 1000000n}ms)`);
+});
+
+test('the helpers still answer safely for a missing sha', () => {
+  assert.equal(audit.gitDiffStatsForCommit(null), null);
+  assert.deepEqual(audit.filesTouchedByCommit(null), []);
+  assert.deepEqual(audit.downstreamImpact(null, ['x']),
+    { commits_after_touching_files: 0, distinct_files_touched: 0, sample_subjects: [] });
+});
+
+test('a path containing a space survives argv — the hand-rolled quoting is gone', () => {
+  // git log -- <pathspec> with a space used to need shell quoting; in argv it is
+  // simply one element. An unmatched pathspec returns empty, never an error.
+  const out = execFileSync('git', ['log', '-1', '--format=%H', '--', 'no such file.md'], { cwd: ROOT, encoding: 'utf8' });
+  assert.equal(out.trim(), '', 'an unmatched pathspec is empty, not a crash');
+});
+

package/tests/conductor.mjs

@@ -130,6 +130,42 @@ test('wandering: lowest priority — emitted after methodology/status advisories
   assert.equal(a[a.length - 1].id, 'wandering', 'wandering is emitted last');
 });
 
+// ---------- evaluateTriggers: interaction profile (task 2010, delivered 1002514) ----------
+//
+// This branch shipped with task 2010 and had NO coverage here, which is part of
+// why the profile could be believed to have no consumer at all. It relays only —
+// interaction-prefs.js resolves — so these pin the relay, plus the one end-to-end
+// fact clause 1 of `accessibility-fluency-profile` turns on.
+
+test('interaction: a profile with inject:true emits the pitch contract', () => {
+  const a = conductor.evaluateTriggers({
+    interaction: { inject: true, contract: 'Interaction profile for this builder — pitch replies accordingly:' },
+  });
+  const i = a.find((x) => x.id === 'interaction');
+  assert.ok(i, 'expected an interaction advisory');
+  assert.match(i.text, /pitch replies accordingly/);
+});
+
+test('interaction: inject:false, an empty contract, or a null knob emit nothing', () => {
+  assert.ok(!ids(conductor.evaluateTriggers({ interaction: { inject: false, contract: 'x' } })).includes('interaction'));
+  assert.ok(!ids(conductor.evaluateTriggers({ interaction: { inject: true, contract: '' } })).includes('interaction'));
+  assert.ok(!ids(conductor.evaluateTriggers({ interaction: null })).includes('interaction'));
+  assert.ok(!ids(conductor.evaluateTriggers({})).includes('interaction'));
+});
+
+// The clause-1 proof, run against the REAL resolver rather than a hand-written
+// payload: the accessible DEFAULT profile — the one a builder who never opens
+// Settings has — must reach a session. Before task 1002514 every default field
+// carried an empty fragment, so describeForApi({}) came back inject:false and
+// this advisory was never emitted for the builder it was written for.
+test('interaction: the DEFAULT profile reaches a session end to end', () => {
+  const interactionPrefs = require('../modules/builder-settings/interaction-prefs.js');
+  const a = conductor.evaluateTriggers({ interaction: interactionPrefs.describeForApi({}) });
+  const i = a.find((x) => x.id === 'interaction');
+  assert.ok(i, 'a builder on all defaults must still be described to the session');
+  assert.match(i.text, /non-technical/);
+});
+
 // The nudge says "your claim's", singular, so it is measured against the claim
 // bound to THIS worktree (task 1003837). These three carry a worktree_name and a
 // matching `worktree` for that reason; the four below pin what changed.

package/tests/hall_settings_world.mjs

@@ -160,6 +160,55 @@ test('the wandering pick is a radio row, wired on change', () => {
   assert.match(radio, /height:\s*24px/, 'a native radio is 13px; the floor is 24');
 });
 
+// ---- the interaction panel (task 1002514) ----------------------------------
+//
+// Three facts a browser is silent about: the panel is rendered by a script that
+// is not settings.js, so the wiring between the two halves is the thing that can
+// silently break; and the carve exists because settings.js is against the
+// 1500-line ratchet, which is a fact a reader will otherwise undo.
+
+test('the interaction panel is wired end to end across its two files', () => {
+  const html = read('settings.html');
+  const panelJs = read('settings-interaction.js');
+
+  // The markup half lives in settings.html and must join a group that already
+  // exists — the rail renders groups, so a section in an unknown data-group is
+  // markup nothing ever shows.
+  const section = html.match(/<section class="scroll" id="interaction-scroll"[^>]*>/);
+  assert.ok(section, 'the panel has a section');
+  assert.match(section[0], /data-group="preferences"/, 'it joins a group the rail already renders');
+  assert.match(section[0], /\bhidden\b/, 'hidden until its own read succeeds, like every other panel');
+  assert.match(html, /<script src="\/builders\/settings-interaction\.js/, 'the page loads the panel script');
+
+  // The script half self-boots and reveals the section. If it stopped doing
+  // either, the panel would simply never appear and no test would notice.
+  assert.match(panelJs, /\$\('#interaction-scroll'\)\.hidden = false/, 'the script reveals its own section');
+  assert.match(panelJs, /setup\(\);/, 'it self-boots — settings.js does not call it');
+
+  // settings.js keeps ONLY the anchor entry, so /settings#interaction activates
+  // the group before the panel paints.
+  assert.match(settingsJs, /'interaction': 'interaction-scroll'/, 'the deep-link anchor stays in settings.js');
+  assert.doesNotMatch(settingsJs, /function renderInteraction\(/, 'the renderer moved out and must not come back inline');
+});
+
+test('the interaction panel stays out of settings.js, which is against the size ratchet', () => {
+  // Not style: inlining this panel put settings.js at 1601 lines and regressed
+  // oversized_file_count 0→1 and excess_lines_total 0→102 (fitness-ratchets.js,
+  // OVERSIZE_LINES = 1500). The settings-sessions.js precedent, same reason.
+  const lines = settingsJs.split('\n').length;
+  assert.ok(lines < 1500, `settings.js is ${lines} lines — at or over the 1500 ratchet; carve the next panel out too`);
+});
+
+test('a default value is named once, by the API, not twice by the row', () => {
+  // The first render read "Non-technical (default) · DEFAULT": interaction-prefs.js
+  // already ends every default value's LABEL with "(default)", and the row also
+  // carried the wandering picker's .prow__tag. One source for the word.
+  const panelJs = read('settings-interaction.js');
+  const render = panelJs.match(/function render\([\s\S]*?\n  \}\n/);
+  assert.ok(render, 'render is a whole function');
+  assert.doesNotMatch(render[0], /prow__tag/, 'the row must not re-state "default" beside a label that already says it');
+});
+
 test('.craft-pref is a 24px target with a 14px drawn box — it was 13x13, the smallest control in the hall', () => {
   const box = ruleOf(panelCss, '.craft-pref');
   assert.ok(box, '.craft-pref has a rule');

package/tests/interaction_prefs.mjs

@@ -6,19 +6,47 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ip = require('../modules/builder-settings/interaction-prefs.js');
 
-test('defaults: unset prefs → all field defaults, empty contract, no inject', () => {
+test('defaults: unset prefs → all field defaults', () => {
   const eff = ip.effectiveProfile({});
   assert.equal(eff.technical_level, 'non_technical');
   assert.equal(eff.toolchain_familiarity, 'new');
   assert.equal(eff.verbosity, 'concise');
-  assert.equal(ip.contractFor({}), '', 'all-default profile injects nothing');
-  assert.equal(ip.shouldInject({}), false);
 });
 
-test('null / missing behaviorPrefs is safe', () => {
+// task 1002514, clause 1 of `accessibility-fluency-profile`. This REPLACES an
+// assertion that the all-default profile injected nothing. That was correct while
+// CLAUDE.md §2 carried the posture as prose, and it meant the accessible-by-
+// default builder — the one who most needs the posture and least likely to open
+// Settings — was the only builder the profile said nothing about.
+test('the DEFAULT profile injects the accessible posture (it is a posture, not an absence)', () => {
+  const c = ip.contractFor({});
+  assert.notEqual(c, '', 'the accessible default must not be the silent one');
+  assert.equal(ip.shouldInject({}), true);
+  assert.match(c, /non-technical/, 'the vocabulary posture must arrive');
+  assert.match(c, /define a term the first time/);
+  assert.match(c, /cost, time and what the end user will see/, 'the framing posture must arrive');
+  assert.match(c, /step by step/, 'the toolchain posture must arrive');
+  assert.match(c, /concise/, 'the length posture must arrive');
+});
+
+test('null / missing behaviorPrefs is safe, and still resolves to the default posture', () => {
   assert.deepEqual(ip.storedProfile(null), {});
-  assert.equal(ip.contractFor(null), '');
-  assert.equal(ip.shouldInject(undefined), false);
+  assert.equal(ip.contractFor(null), ip.contractFor({}), 'absent prefs resolve exactly like empty prefs');
+  assert.equal(ip.shouldInject(undefined), true);
+});
+
+// The criterion's hard constraint: "an expert's terse experience is never
+// degraded to help a newcomer." The expert contract must not merely differ from
+// the newcomer one — it must be SHORTER, and it must tell the agent to skip.
+test('an expert profile stays terse where a non-technical one is explained to', () => {
+  const beginner = ip.contractFor({});
+  const expert = ip.contractFor({
+    interaction: { technical_level: 'engineer', toolchain_familiarity: 'comfortable' },
+  });
+  assert.ok(expert.length < beginner.length, 'the expert contract must be shorter, not just different');
+  assert.match(expert, /skip basic explanations/);
+  assert.doesNotMatch(expert, /do not assume software-engineering vocabulary/);
+  assert.doesNotMatch(expert, /walk local tooling/);
 });
 
 test('a non-default field produces an injected contract', () => {
@@ -76,10 +104,21 @@ test('describeForApi exposes catalog + effective + contract + inject', () => {
 // The SURFACE half of the profile: how much of the work behind a reply gets
 // narrated. Default `show` keeps every existing builder on today's behavior.
 
-test('machinery defaults to show and injects nothing', () => {
+// The assertion here used to be `contractFor({machinery:'show'}) === ''`, which
+// measured the WHOLE contract's emptiness to prove one field contributed nothing.
+// That conflated "this field is silent" with "every field is silent", so once the
+// other defaults gained text (task 1002514) it would have gone red for a reason
+// that had nothing to do with machinery. Same intent, pointed at the actual claim:
+// adding `show` changes nothing, and `show` never names itself.
+test('machinery defaults to show and contributes nothing to the contract', () => {
   assert.equal(ip.defaultValue('machinery'), 'show');
   assert.equal(ip.effectiveProfile({}).machinery, 'show');
-  assert.equal(ip.contractFor({ interaction: { machinery: 'show' } }), '', 'the default must never spend session context');
+  assert.equal(
+    ip.contractFor({ interaction: { machinery: 'show' } }),
+    ip.contractFor({}),
+    'an explicit `show` must read identically to leaving it unset',
+  );
+  assert.doesNotMatch(ip.contractFor({}), /Machinery/, 'the default must never spend session context');
 });
 
 test('machinery=quiet injects an outcomes-not-mechanism contract', () => {