@bongos/core 1.19.772 → 1.19.774

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.772'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.774'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/manifest-schema.js

@@ -45,6 +45,12 @@
 //                                       //   it may be enabled where anyone can sign up. src/modules.js
 //                                       //   refuses the enablement when the join door is `open` and no
 //                                       //   payer is configured.
+//     "declarativeSeams": {             // OPTIONAL. Per-entry exemptions for the seam-wiring
+//       "pollers": ["box-lifecycle"]    //   guard (task 1003819): "this contributes entry ships no
+//     },                                //   artifact ON PURPOSE". Every key must be a key the module
+//                                       //   actually declares in `contributes`, and every entry must be
+//                                       //   one it actually lists there — a typo'd exemption is an error,
+//                                       //   never a silent pass.
 //     "provides":      ["reward"],      // OPTIONAL. seam PORTS this module registers a provider for.
 //     "consumes":      ["grade"],       // OPTIONAL. seam ports this module resolves (required capabilities).
 //     "prerequisites": { "modules": ["economy"] },  // OPTIONAL. other modules that must be enabled.
@@ -117,6 +123,30 @@ const isWebSurface = (v) =>
   isObj(v) && isWebSurfaceDir(v) && (v.apexRoot === true ? !('host' in v) : isStr(v.host));
 const isWebSurfaceArray = (v) => Array.isArray(v) && v.every(isWebSurface);
 
+// The entries a module declares for one `contributes` seam, normalised to a list.
+// `migrations: true` is the one implicit entry (the modules/<key>/migrations/ dir);
+// every array seam yields its own entries; an empty array declares nothing.
+//
+// SINGLE SOURCE, deliberately. This pair lives here rather than in the seam-wiring
+// guard that also needs it (scripts/gds/seam-wiring-guard.js, task 1003819), because
+// "what entries does this contributes block declare, and what is each one called" is
+// schema knowledge — and two copies would be exactly the second list that drifts,
+// with the drift landing on the guard's exemption cross-check.
+function declaredEntries(seam, value) {
+  if (seam === 'migrations') return value === true ? [true] : (Array.isArray(value) ? value : []);
+  return Array.isArray(value) ? value : [];
+}
+
+// A declared entry's stable display name — what a declarativeSeams exemption names.
+// webSurfaces entries are objects and `migrations: true` is implicit, so neither is
+// its own label; everything else is already a string.
+function entryLabel(seam, entry) {
+  if (seam === 'migrations' && entry === true) return 'migrations/';
+  if (seam !== 'webSurfaces') return String(entry);
+  if (!isObj(entry)) return String(entry);
+  return entry.apexRoot === true ? `apexRoot:${entry.dir}` : `${entry.host}(${entry.dir})`;
+}
+
 function validateManifest(obj) {
   const errors = [];
   const E = (msg) => errors.push(msg);
@@ -206,6 +236,54 @@ function validateManifest(obj) {
     }
   }
 
+  // --- optional declarativeSeams (task 1003819) ---
+  // The exemption list for the seam-wiring guard: "this contributes entry ships no
+  // artifact on purpose". Some declarations are legitimately declarative-only —
+  // dev-box's `box-lifecycle` poller runs on the control plane, not in this process,
+  // and its `boxes` uiSection ships no hall widget — so the guard needs a way to say
+  // so without a blanket skip that would hide the real cases it exists to catch.
+  //
+  // Validated HERE, against `contributes`, because this is the one place that holds
+  // both: an exemption naming a seam the module does not declare, or an entry it does
+  // not list, is an ERROR rather than a no-op. A typo'd exemption that quietly
+  // validated would exempt nothing while reading as though it exempted something —
+  // the failure mode the closed key sets on `contributes`/`maintenance`/`spend` exist
+  // to prevent, in the direction that hides a defect. The guard itself (the on-disk
+  // artifact check, and whether an exemption has gone STALE because the artifact
+  // now exists) lives in scripts/gds/seam-wiring-guard.js, which needs the filesystem.
+  if ('declarativeSeams' in obj) {
+    const ds = obj.declarativeSeams;
+    if (!isObj(ds)) {
+      E('declarativeSeams: must be an object of { "<contributes seam>": ["<entry>", …] }');
+    } else {
+      const contributes = isObj(obj.contributes) ? obj.contributes : {};
+      for (const [seam, entries] of Object.entries(ds)) {
+        if (!ALLOWED_CONTRIBUTES.includes(seam)) {
+          E(`declarativeSeams.${seam}: unknown seam (allowed: ${ALLOWED_CONTRIBUTES.join(', ')})`);
+          continue;
+        }
+        if (!isStrArray(entries)) {
+          E(`declarativeSeams.${seam}: must be an array of non-empty strings`);
+          continue;
+        }
+        if (!(seam in contributes)) {
+          E(`declarativeSeams.${seam}: the module does not declare contributes.${seam} — an exemption for a seam it never contributes exempts nothing`);
+          continue;
+        }
+        // Compared against the LABELS, not the raw values, so the check spans every
+        // seam — webSurfaces declares objects and `migrations: true` is implicit, and
+        // an earlier cut that matched raw strings silently skipped both, letting
+        // `declarativeSeams: { webSurfaces: ['bogus'] }` validate clean.
+        const labels = declaredEntries(seam, contributes[seam]).map((e) => entryLabel(seam, e));
+        for (const entry of entries) {
+          if (!labels.includes(entry)) {
+            E(`declarativeSeams.${seam}: "${entry}" is not in contributes.${seam} (${labels.join(', ') || 'empty'}) — an exemption must name an entry the module actually declares`);
+          }
+        }
+      }
+    }
+  }
+
   // --- optional spend declaration (task 1003884) ---
   if ('spend' in obj) {
     const sp = obj.spend;
@@ -255,6 +333,6 @@ function assertValidManifest(obj, label = 'module.json') {
 }
 
 module.exports = {
-  validateManifest, assertValidManifest, KEY_RE, ALLOWED_CONTRIBUTES, ARRAY_OF_STRING_KEYS, ATTRIBUTION_KEYS,
+  validateManifest, assertValidManifest, declaredEntries, entryLabel, KEY_RE, ALLOWED_CONTRIBUTES, ARRAY_OF_STRING_KEYS, ATTRIBUTION_KEYS,
   MAINTENANCE_STATUSES, MAINTENANCE_KEYS, SUNSET_STATUSES,
 };

package/tests/catalog_only_client.mjs

@@ -227,14 +227,17 @@ test('mounting the projects routes registers the `project.catalog` port', async
   assert.ok(Object.isFrozen(catalog.projectCatalogPort), 'a consumer must not be able to re-point the port');
 });
 
-test('the port declares the catalog write, one presence read, and nothing else', () => {
-  // Two verbs, and the reason for the ceiling is unchanged: a consumer maps its own row onto
+test('the port declares the catalog write, one presence read, the disconnect delete, and nothing else', () => {
+  // Three verbs, and the reason for the ceiling is unchanged: a consumer maps its own row onto
   // the entry shape and asks about ORIGINS, so the catalog never learns another module's
   // schema and no module gets a general-purpose handle on these tables. `catalogued` arrived
   // with the backfill (task 1003581) because healing history without a presence read means
-  // re-writing every catalog row at every boot. Anything wider than these two is a new
-  // decision, and this list is where it has to be made.
-  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'publish']);
+  // re-writing every catalog row at every boot. `forget` arrived with "Disconnect from Bongos
+  // entirely" (task 1003249, ADR 0290): a released name and address cannot leave a hidden row
+  // behind, and it takes the same {clientId, origin, ownerGithubId} a publish carries, under
+  // the same two claim rules. Anything wider is a new decision, and this list is where it has
+  // to be made.
+  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'forget', 'publish']);
 });
 
 test('the module manifest DECLARES the port it registers', async () => {

package/tests/fitness.mjs

@@ -421,6 +421,28 @@ test('module-migrations-additive actually CATCHES destructive + non-namespaced D
   // but a BARE drop constraint (no matching re-add) is STILL destructive
   assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT (no re-add) must still be flagged');
 
+  // an ACKNOWLEDGED contract-phase column drop (task 1003092, ADR 0177's expand-then-
+  // contract) is the ONE destructive shape allowed: the file carries the same
+  // `-- forward-unsafe:` pragma lint-migrations.js requires, the statement is exactly
+  // one DROP COLUMN, and the table is the module's own.
+  const PRAGMA = '-- forward-unsafe: drop-column on dev_box_runs — the contract phase of a two-step rename\n';
+  const contract = fitness.moduleMigrationViolations('dev-box',
+    PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN IF EXISTS note;\nALTER TABLE dev_box_runs ALTER COLUMN note2 SET NOT NULL;');
+  assert.deepEqual(contract, [], 'an acknowledged own-table DROP COLUMN must pass: ' + contract.join('; '));
+  // the pragma is per-STATEMENT permission for that one shape, not a per-file switch
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'DROP TABLE dev_box_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'TRUNCATE dev_box_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN note, DROP COLUMN note2;').some((v) => /destructive/i.test(v)), 'a multi-clause drop is not the one allowed shape');
+  // and a column drop on a table OUTSIDE the namespace is refused twice over
+  const foreign = fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE builders DROP COLUMN note;');
+  assert.ok(foreign.some((v) => /destructive/i.test(v)), 'a core-table DROP COLUMN is still destructive under the pragma');
+  assert.ok(foreign.some((v) => /namespace/i.test(v)), 'and still a namespace violation');
+  // the real contract migration is the shape's first user — it must pass the REAL check
+  assert.equal(fitness.moduleMigrationViolations('platform-identity',
+    fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'migrations', 'platform_identity_021_drop_legacy_role.sql'), 'utf8')).length, 0,
+    'platform_identity_021 is the acknowledged contract phase and must be clean');
+
   // a created object outside the <key>_ namespace is rejected
   assert.ok(fitness.moduleMigrationViolations('dev-box', 'CREATE TABLE runs (id int);').some((v) => /namespace/i.test(v)), 'a table outside dev_box_ must be flagged');
   // a module migration altering a CORE table is rejected (reach core via the seam)

package/tests/goal_scope_check.mjs

@@ -18,7 +18,8 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const gsc = require('../src/bongos/goal-scope-check.js');
 const { touchesOverlap } = require('../src/bongos/path-match.js');
-const { globsForModules, isModuleKey, protectedModules } = require('../src/bongos/module-scope-map.js');
+const { PROTECTED_GLOBS: protectedGlobs } = require('../src/bongos/permission-path-check.js');
+const { globsForModules, isModuleKey, protectedModules, SHARED_GLOBS, SHARED_GLOBS_RAW } = require('../src/bongos/module-scope-map.js');
 
 let passed = 0;
 let failed = 0;
@@ -102,6 +103,67 @@ t('the subset does NOT use symmetric touchesOverlap (which would leak the broad
     'goal-scope-check must REJECT the broad touch despite the symmetric overlap');
 });
 
+// ---------- the shared floor: tests/ is inside EVERY wall (task 1003655) ----------
+//
+// `tests/` belongs to no module, and every real task adds a test — so before the
+// shared floor existed the create gate refused any task that honestly declared its
+// own test file, whichever goal it was filed under (idea 1000816). These cases pin
+// both halves: the floor is reachable from any scope, and it did not become a hole.
+
+t('shared floor: a test file passes under a goal scoped to an unrelated module', () => {
+  const r = gsc.check(['art-pipeline'], ['tests/idea_routing.mjs'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+  // and it is NOT because art-pipeline owns it — no module does.
+  assert.equal(gsc.isCovered('tests/idea_routing.mjs', globsForModules(['art-pipeline'])), false);
+});
+
+t('shared floor: sub-Metic too — the floor is scope, not rank (tests/ is unprotected)', () => {
+  assert.equal(gsc.check(['game'], ['tests/seats.mjs'], 'thetes').ok, true);
+});
+
+t('shared floor: the realistic mixed task — module code PLUS its own test', () => {
+  const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+});
+
+t('shared floor is reported separately and NEVER folded into goal_globs', () => {
+  // check()'s unknown_scope guard tests goal_globs.length === 0; folding the
+  // always-present shared globs in would give a garbage scope a non-empty
+  // territory and slip it past that fail-closed edge.
+  const s = gsc.scopeSubset(['art-pipeline'], ['tests/x.mjs']);
+  assert.equal(s.ok, true);
+  assert.deepEqual(s.shared_globs, ['tests/']);
+  assert.ok(!s.goal_globs.includes('tests/'), 'goal_globs must stay module-resolved only');
+  const garbage = gsc.scopeSubset(['not-a-real-module'], ['tests/x.mjs']);
+  assert.equal(garbage.goal_globs.length, 0, 'an unknown scope still resolves to zero territory');
+});
+
+t('shared floor does not defeat the other fail-closed edges', () => {
+  assert.equal(gsc.check(['not-a-real-module'], ['tests/x.mjs'], 'metic').code, 'unknown_scope');
+  assert.equal(gsc.check([], ['tests/x.mjs'], 'metic').code, 'empty_scope');
+  assert.equal(gsc.check(['art-pipeline'], [], 'metic').code, 'empty_touches');
+});
+
+t('shared floor is NARROW: it opens tests/ and nothing else', () => {
+  assert.deepEqual([...SHARED_GLOBS], ['tests/']);
+  // the sibling roots that DO have owners must still be walled to their owner
+  assert.equal(gsc.check(['art-pipeline'], ['.claude/skills/status/SKILL.md'], 'metic').code, 'out_of_scope');
+  assert.equal(gsc.check(['art-pipeline'], ['docs/adr/0288-x.md'], 'metic').code, 'out_of_scope');
+  assert.equal(gsc.check(['art-pipeline'], ['src/bongos/auth.js'], 'metic').code, 'out_of_scope');
+  // …and a lookalike sibling dir is not swept in by the name prefix
+  assert.equal(gsc.check(['art-pipeline'], ['tests-e2e/x.mjs'], 'metic').code, 'out_of_scope');
+});
+
+t('shared floor is DERIVED fail-closed: a protected glob could never take effect', () => {
+  // The exported list filters its own literal against PROTECTED_GLOBS, so a future
+  // edit adding e.g. 'migrations/' would drop out rather than widen every goal's
+  // wall into the trust core. Today the raw literal is already clean.
+  assert.deepEqual([...SHARED_GLOBS], SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], protectedGlobs)));
+  for (const g of SHARED_GLOBS) {
+    assert.equal(touchesOverlap([g], protectedGlobs), false, `shared glob ${g} overlaps the protected core`);
+  }
+});
+
 // ---------- fail-closed edges ----------
 
 t('empty-touches reject: a task with no touches[] cannot be scope-checked', () => {

package/tests/hall_settings_world.mjs

@@ -127,7 +127,11 @@ test('a toggle is a role=switch with aria-checked, and the page script keeps dat
   assert.match(fn[0], /data-on="\$\{on \? '1' : '0'\}"/, 'and data-on stays, because every delegated click handler reads it');
   assert.match(fn[0], /sw__track[\s\S]*sw__knob/, 'drawn as a track and a knob');
   assert.doesNotMatch(settingsJs, /aria-pressed/, 'no aria-pressed toggles are left on the page');
-  for (const fnName of ['renderSounds', 'renderRender', 'renderCrossProject', 'privacyRow']) {
+  // renderRender is deliberately absent: the Rendering panel stopped being a
+  // toggle in task 1002518 (four rungs, not on/off), so it became a radio group
+  // in settings-render.js — covered by the radio assertions and the wiring test
+  // below, not by the switch contract.
+  for (const fnName of ['renderSounds', 'renderCrossProject', 'privacyRow']) {
     const body = settingsJs.match(new RegExp(`function ${fnName}\\([\\s\\S]*?\\n  \\}\\n`));
     assert.ok(body && /switchHtml\(/.test(body[0]), `${fnName} renders the switch`);
   }
@@ -199,6 +203,58 @@ test('the interaction panel stays out of settings.js, which is against the size
   assert.ok(lines < 1500, `settings.js is ${lines} lines — at or over the 1500 ratchet; carve the next panel out too`);
 });
 
+// ---- the Rendering panel, carved out the same way (task 1002518) -----------
+//
+// Same two-file shape as the interaction panel above, and the same reason: the
+// knob became a four-rung ladder with a DERIVED default, which is more UI than
+// settings.js has room for. The extra fact this panel has to keep true is that
+// its "default" row explains itself — the default is computed from another
+// panel's answers, so a bare "default" tag would name a choice without naming
+// who made it.
+
+test('the rendering panel is wired end to end across its two files', () => {
+  const html = read('settings.html');
+  const panelJs = read('settings-render.js');
+
+  const section = html.match(/<section class="scroll" id="render-scroll"[^>]*>/);
+  assert.ok(section, 'the panel has a section');
+  assert.match(section[0], /data-group="preferences"/, 'it joins a group the rail already renders');
+  assert.match(section[0], /\bhidden\b/, 'hidden until its own read succeeds');
+  assert.match(html, /<script src="\/builders\/settings-render\.js/, 'the page loads the panel script');
+
+  assert.match(panelJs, /\$\('#render-scroll'\)\.hidden = false/, 'the script reveals its own section');
+  assert.match(panelJs, /setup\(\);/, 'it self-boots — settings.js does not call it');
+
+  // settings.js keeps ONLY the anchor entry.
+  assert.match(settingsJs, /'rendering': 'render-scroll'/, 'the deep-link anchor stays in settings.js');
+  assert.doesNotMatch(settingsJs, /function renderRender\(/, 'the renderer moved out and must not come back inline');
+  assert.doesNotMatch(settingsJs, /loadRender\(\)/, 'and settings.js no longer calls it');
+});
+
+test('the rendering panel is a radio group, wired on change, and can clear the override', () => {
+  const panelJs = read('settings-render.js');
+  const render = panelJs.match(/function render\([\s\S]*?\n  \}\n/);
+  assert.ok(render, 'render is a whole function');
+  assert.match(render[0], /<input class="pradio" type="radio" name="render-level"/, 'a real radio group');
+  assert.match(render[0], /<label class="prow prow--pick"/, 'the whole row is the radio\'s label');
+  const setup = panelJs.match(/async function setup\([\s\S]*?\n  \}\n/);
+  assert.match(setup[0], /addEventListener\('change'/, 'a radio fires change, not click');
+  assert.match(setup[0], /closest\('\.pradio'\)/);
+  // The sentinel row must send null, not a level: pinning the rung that happens
+  // to be derived today would silently stop tracking the interaction profile.
+  assert.match(panelJs, /widgets: value === USE_DEFAULT \? null : value/,
+    'choosing "match my profile" CLEARS the override rather than pinning a level');
+});
+
+test('the derived default explains itself, because it is computed elsewhere', () => {
+  // Unlike every other picker on the page, "default" here is not a constant —
+  // render-prefs.js derives it from the interaction profile. A row that said
+  // only "default" would name a choice the reader never made and cannot see.
+  const panelJs = read('settings-render.js');
+  assert.match(panelJs, /derived_reason/, 'the row states WHY the default landed where it did');
+  assert.match(panelJs, /derived_level/, 'and WHICH rung that is');
+});
+
 test('a default value is named once, by the API, not twice by the row', () => {
   // The first render read "Non-technical (default) · DEFAULT": interaction-prefs.js
   // already ends every default value's LABEL with "(default)", and the row also

package/tests/hub_disconnect_ui.mjs

@@ -0,0 +1,105 @@
+// tests/hub_disconnect_ui.mjs
+//
+// The manage page's "Disconnect from Bongos entirely" card (task 1003249, ADR 0290).
+//
+// "Take it offline" is reversible and says so; this is the owner's TRUE delete, so it lives in
+// its own card after the ender — never folded into it, where the reversible control could read
+// as the destructive one. What these pins hold:
+//   • the card is real markup, after "Take it offline", with its fold a SIBLING of the volatile
+//     slot (the #mDelWhat shape), itemising what is erased and what is kept, and saying it
+//     cannot be undone — with no wall-clock promise
+//   • the ask is the name typed back; the act re-checks it at click time and SENDS it, because
+//     the route checks it again (confirm_slug)
+//   • the minute tick never repaints over a half-typed name (a project-scoped guard), and an open
+//     run is named rather than offering a button the server would refuse
+//   • the copy that said nothing on this page erases a project was true until this card: it now
+//     scopes that promise to "Take it offline", and the fold points at the card
+//   • the design kit's stub answers the ask, so the probe drives it end to end
+//
+// Run:  node tests/hub_disconnect_ui.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+const fn = (name) => (SCRIPT.match(new RegExp(`function ${name}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n  \\}`)) || [, ''])[1];
+const PROMISE = /shortly|briefly|minute|second|soon\b/i;
+
+test('the card is real markup, after "Take it offline", with the fold outside the volatile slot', () => {
+  const del = HUB.indexOf('id="mDelete"');
+  const card = (HUB.match(/<div class="card mSec" id="mDisconnect">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
+  assert.ok(card, '#mDisconnect must be extractable');
+  assert.ok(del > 0 && HUB.indexOf('id="mDisconnect"') > del, 'the true delete comes after the reversible ender');
+  assert.match(card, /<h2>Disconnect from Bongos entirely<\/h2>/);
+  const slot = card.indexOf('id="mDisc"'), fold = card.indexOf('id="mDiscWhat"');
+  assert.ok(slot > 0 && fold > slot, 'the fold is a sibling after the slot, so no re-render can drop it');
+});
+
+test('the fold itemises what is erased and what is kept, says it cannot be undone, and promises no time', () => {
+  const fold = (HUB.match(/<details class="finePrint" id="mDiscWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold);
+  assert.match(fold, /<summary>What this erases — and what it keeps<\/summary>/);
+  for (const erased of [/database/, /nightly backup/, /place on the map/, /members/, /name and web address are released/]) {
+    assert.match(fold, erased, `names what is erased: ${erased}`);
+  }
+  assert.match(fold, /<b>Kept:<\/b> your repository on GitHub/);
+  assert.match(fold, /GitHub sign-in app/, 'the one thing GitHub will not let the platform remove is named, with where to remove it');
+  assert.match(fold, /cannot be undone/);
+  assert.match(fold, /<b>Take it offline<\/b> above/, 'the reversible alternative is pointed at');
+  assert.doesNotMatch(fold, PROMISE);
+});
+
+test('the ask is the name typed back, and the act re-checks it and SENDS it for the server to check again', () => {
+  const ask = fn('askDisconnect');
+  assert.ok(ask, 'askDisconnect() must be extractable');
+  assert.match(ask, /mDiscAsking = inst\.slug;/);
+  assert.match(ask, /Type the project’s name to confirm/);
+  assert.match(ask, /id="mDiscName"/);
+  assert.match(ask, /data-disc-yes disabled/);
+  assert.match(ask, /data-disc-no/);
+  assert.match(ask, /cannot be undone/);
+  const act = fn('doDisconnect');
+  assert.match(act, /if \(!inst \|\| !discTypedMatches\(\)\) return;/, 'an enabled-LOOKING button cannot act');
+  assert.match(act, /'\/disconnect'/);
+  assert.match(act, /JSON\.stringify\(\{ confirm_slug: /, 'the typed name travels as confirm_slug');
+  assert.match(act, /loadManage\(true\)/, 'the page re-reads the project so the queued run shows');
+});
+
+test('the render guards a half-typed name per project, names an open run, and offers the button otherwise', () => {
+  const render = fn('renderDisconnect');
+  assert.ok(render, 'renderDisconnect() must be extractable');
+  assert.match(render, /if \(mDiscAsking && mDiscAsking === inst\.slug\) return;/);
+  assert.match(render, /open\.action === 'disconnect'/);
+  assert.match(render, /This project is being disconnected\./);
+  assert.match(render, /Disconnecting waits for the current /, 'another open run is named, no button the server would refuse');
+  assert.match(render, /data-disc-ask/);
+  assert.doesNotMatch(render, PROMISE);
+  assert.match(SCRIPT, /renderDelete\(inst\);\n[\s\S]{0,200}renderDisconnect\(inst\);/, 'rendered on the same fetch-free tick as the ender');
+});
+
+test('the ender no longer claims nothing on the page erases — it scopes that to itself and points at the card', () => {
+  const truth = fn('teardownTruth');
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both shapes');
+  assert.doesNotMatch(HUB, /Nothing here erases a project/);
+  const delFold = (HUB.match(/<details class="finePrint" id="mDelWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.doesNotMatch(delFold, /no permanent-delete button/i, 'the capability exists now');
+  assert.match(delFold, /<b>Disconnect from Bongos entirely<\/b> below/);
+  assert.match(fn('renderDelete'), /open_intent\.action === 'disconnect'/, 'a queued disconnect is not offered a teardown the server would refuse');
+});
+
+test('the design kit stub answers the ask, and a probe drives it end to end', () => {
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /\(teardown\|restart\|domain\|disconnect\)/);
+  assert.match(stub, /disconnect: \{ queued: true, message: /);
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
+  const p = probes.find((x) => /disconnect/.test(x.name));
+  assert.ok(p, 'a disconnect probe exists');
+  assert.ok(p.steps.some((s) => s[0] === 'fill' && s[1] === '#mDiscName'));
+  assert.ok(p.steps.some((s) => s[0] === 'click' && s[1] === '[data-disc-yes]'));
+});

package/tests/land_watch.mjs

@@ -89,6 +89,50 @@ t('falls back to the task row for title/value when the crumb lacks them', () =>
   assert.ok(/From task row/.test(env.html), 'title should come from the fresh task row');
 });
 
+// ── the card-richness rung survives the async land (task 1002518) ────────────────────
+//
+// This is the path the ladder is easiest to lose on. The card a CI land renders is
+// built minutes later, in another process, from the breadcrumb alone — so if the
+// crumb does not carry the rung the shipping session resolved, the shipped card
+// silently reverts to the default rendering and the builder's choice is honoured
+// everywhere EXCEPT the one card that says the work actually landed.
+
+t('a crumb carrying cardFlags renders at that rung — rich opens the summary', () => {
+  const flags = { level: 'rich', showCard: true, showWidget: true, expanded: true };
+  const env = buildShippedEnvelope({ ...CRUMB, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, true);
+  assert.match(env.html, /<div style="display:block;margin-top:0\.6rem/, 'the rich rung opens the summary on arrival');
+});
+
+t('cardFlags at a non-widget rung writes no widget, whatever the legacy boolean says', () => {
+  // widgetsEnabled:true is left on the crumb deliberately — cardFlags must WIN.
+  // A crumb written by this CLI carries both, so the precedence is what decides
+  // the render, not which field happens to be present.
+  const flags = { level: 'text', showCard: true, showWidget: false, expanded: false };
+  const env = buildShippedEnvelope({ ...CRUMB, widgetsEnabled: true, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, false, 'the rung decides, not the legacy boolean');
+  assert.ok(env.markdown && /Shipped/.test(env.markdown), 'the monospace card still carries the land');
+});
+
+t('the standard rung leaves the summary folded — expanded is not assumed from showWidget', () => {
+  const flags = { level: 'standard', showCard: true, showWidget: true, expanded: false };
+  const env = buildShippedEnvelope({ ...CRUMB, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, true);
+  assert.match(env.html, /<div style="display:none;margin-top:0\.6rem/, 'folded, as the standard rung means');
+});
+
+t('a crumb WITHOUT cardFlags still reads the legacy boolean — older crumbs on disk', () => {
+  // A breadcrumb written before this shipped is sitting on someone's machine right
+  // now, and land-watch will read it. It must render exactly as it always did.
+  for (const widgetsEnabled of [true, false]) {
+    const env = buildShippedEnvelope({ ...CRUMB, widgetsEnabled, cardFlags: undefined }, { status: 'shipped' });
+    assert.equal(env.widgets_enabled, widgetsEnabled, `legacy crumb (${widgetsEnabled}) keeps its meaning`);
+    if (widgetsEnabled) {
+      assert.match(env.html, /<div style="display:none;margin-top:0\.6rem/, 'a legacy crumb never renders expanded');
+    }
+  }
+});
+
 // ── watch() orchestration (injected deps — no disk, no network) ──────────────────────
 await ta('emits the NEWEST shipped card, keeps confirmed, drops the rest — one card per run', async () => {
   const removed = [];

package/tests/membership_kind_lockstep.mjs

@@ -91,45 +91,104 @@ for (const m of EXPAND_MIGRATIONS) {
   });
 }
 
-test('the value mapping is one shared function, not repeated inline', () => {
-  // Route, sender and trigger must agree that 'builder' ⇄ 'member'; three copies of a
-  // ternary is how they would stop agreeing.
-  const pi = read('modules/platform-identity/platform-identity.js');
-  assert.match(pi, /function membershipKindFromLegacy\(/);
-  assert.match(pi, /function legacyRoleFromKind\(/);
-  const sso = read('modules/platform-identity/routes/sso.js');
-  assert.match(sso, /pi\.membershipKindFromLegacy\(role\)/,
-    'the check-in translates the legacy field through the shared mapping');
+test('the expand-phase trigger mapped the value pair in BOTH directions (history, still readable)', () => {
+  // 010 is history now — 021 dropped the trigger — but the expand migration stays
+  // in the tree (a from-scratch replay must still match), so its shape stays pinned:
+  // this is the trigger the no-DEFAULT rule above exists for.
   const sql = read('modules/platform-identity/migrations/platform_identity_010_membership_kind.sql');
-  assert.match(sql, /CASE WHEN NEW\.role = 'builder' THEN 'member'/, 'the trigger maps the same pair');
-  assert.match(sql, /CASE WHEN NEW\.membership_kind = 'member' THEN 'builder'/);
+  assert.match(sql, /CASE WHEN NEW\.role = 'builder' THEN 'member'/, 'the trigger maps the legacy value in');
+  assert.match(sql, /CASE WHEN NEW\.membership_kind = 'member' THEN 'builder'/, 'and the new value out');
 });
 
-test('the sender writes BOTH spellings, computing the kind once (the cross-version window)', () => {
+test('the sender writes ONE spelling, computing the kind once (the window is closed)', () => {
   // task 1003206: the auth flows are auth.js + auth-*.js now — read the family.
+  // During the window (task 1003090) this body carried BOTH spellings; task 1003092
+  // closed it. The legacy field must not come back: the hub schema is strict, so
+  // re-adding it would turn every federated check-in into a 400.
   const auth = authSource();
   const body = auth.slice(auth.indexOf('async function reportMembershipCheckIn'), auth.indexOf('async function reportMembershipCheckIn') + 2400);
-  assert.match(body, /membership_kind: kind/, 'the new field goes on the wire');
-  assert.match(body, /role: kind === 'member' \? 'builder' : kind/,
-    'and the legacy field too — an un-upgraded hub would otherwise drop the owner flag');
+  assert.match(body, /membership_kind: kind/, 'the field goes on the wire');
+  assert.ok(!/\brole:/.test(body),
+    'the legacy field is gone from the wire — the hub no longer accepts it (task 1003092)');
   assert.equal((body.match(/membershipKind\(\{ githubLogin \}\)/g) || []).length, 1,
-    'the kind is computed ONCE per check-in, not per field');
+    'the kind is computed ONCE per check-in');
+});
+
+test('the translator functions are gone from the domain module (nothing left to translate)', () => {
+  const pi = read('modules/platform-identity/platform-identity.js');
+  assert.ok(!/membershipKindFromLegacy/.test(pi), 'membershipKindFromLegacy was the window; the window is closed');
+  assert.ok(!/legacyRoleFromKind/.test(pi), 'legacyRoleFromKind likewise');
+  const sso = read('modules/platform-identity/routes/sso.js');
+  assert.ok(!/membershipKindFromLegacy/.test(sso), 'the route no longer translates anything');
 });
 
-// ── THE CONTRACT PHASE — the test of the shim's own removal (task 1003089) ─────
+// ── THE CONTRACT PHASES — the tests of the shims' own removal ──────────────────
 //
 // ADR 0174's Lineage lesson: a time-boxed shim outlives its release unless its
-// removal ships with the test that says it is gone. core_240 closed the GOAL
-// membership window — the trigger, the function and `goal_members.role` are all
-// dropped, and `membership_kind` carries NOT NULL + DEFAULT itself rather than
-// resting on a trigger surviving.
-//
-// The PROJECT membership half (platform_identity_010) is deliberately NOT here:
-// it is still inside its cross-version federation window, its contract phase is
-// task 1003092, and the expand-phase block above is what still guards it. Do not
-// merge the two — the whole point of the pair is that they close on different
-// schedules.
+// removal ships with the test that says it is gone. The two windows closed on
+// DIFFERENT schedules, which is the whole point of the pair:
+//   • core_240 (task 1003089) closed the GOAL membership window one release later;
+//   • platform_identity_021 (task 1003092) closed the PROJECT membership window
+//     only once every federated instance that can check in was past core 1.19.241,
+//     because its writer is another instance (ADR 0177 §"the window closed").
+// In both, the trigger, the function and the legacy column are dropped, and
+// `membership_kind` carries NOT NULL + DEFAULT itself rather than resting on a
+// trigger surviving.
 const CONTRACT = 'migrations/core_240_goal_members_drop_legacy_role.sql';
+const PI_CONTRACT = 'modules/platform-identity/migrations/platform_identity_021_drop_legacy_role.sql';
+
+test('platform_identity_021: the contract phase drops the trigger, the function AND the column', () => {
+  const sql = read(PI_CONTRACT);
+  assert.match(sql, /DROP TRIGGER IF EXISTS platform_identity_membership_kind_lockstep\s+ON platform_identity_project_memberships/);
+  assert.match(sql, /DROP FUNCTION IF EXISTS platform_identity_membership_kind_lockstep\(\)/,
+    'the FUNCTION outlives the trigger unless it is dropped by name');
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships DROP COLUMN IF EXISTS role/);
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships ALTER COLUMN membership_kind SET NOT NULL/,
+    'the guarantee 010 deferred to step 2 arrives here, or the column never gets one');
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships ALTER COLUMN membership_kind SET DEFAULT 'member'/,
+    'safe only NOW: a default while the legacy column was still written is the task-1003090 bug');
+  // The last backfill must carry the VALUE rename too — a stray legacy 'builder'
+  // must never land in membership_kind, whose CHECK does not admit it.
+  assert.match(sql, /CASE WHEN role = ''builder'' THEN ''member'' ELSE role END/,
+    'the guarded backfill maps the craft name, not just copies the column');
+  const trigDrop = sql.indexOf('DROP TRIGGER IF EXISTS platform_identity_membership_kind_lockstep');
+  const colDrop = sql.indexOf('DROP COLUMN IF EXISTS role');
+  assert.ok(trigDrop > -1 && trigDrop < colDrop,
+    'the trigger goes BEFORE the column: plpgsql bodies are not dependency-tracked, so a survivor fails at the next write');
+});
+
+test('platform_identity_021: the forward-unsafe pragma is present, and its FIRST line carries the gating fact', () => {
+  const scan = lint.scanMigrationSql(read(PI_CONTRACT));
+  assert.deepEqual([...scan.unsafe].sort(), ['drop-column', 'set-not-null'],
+    'the linter must still SEE both operations — an acknowledged migration is not an exempt one');
+  assert.ok(scan.acknowledged, 'a drop-column with no pragma is unacknowledged forward-unsafety');
+  // The one fact that makes THIS drop safe is not a hub release alone — it is that
+  // every federated sender is past the release carrying the expand phase.
+  assert.match(scan.ackReason, /1\.19\.241/,
+    'the pragma must name the release the senders had to be past, not merely assert safety');
+  assert.match(scan.ackReason, /federated instance/i,
+    'and say the condition was about the SENDERS — the cross-version window is what made this one different');
+});
+
+test('no platform-identity migration outside the three that own its lifecycle still names project_memberships.role', () => {
+  // Comments are stripped first: the history may DISCUSS the old column; this rule
+  // is about statements. The exemptions are the migrations that created the column,
+  // expanded away from it, and dropped it.
+  const OWNS_ITS_LIFECYCLE = new Set([
+    'platform_identity_003_project_memberships.sql',  // created it
+    'platform_identity_010_membership_kind.sql',      // expand: backfilled from it; the trigger kept it in step
+    'platform_identity_021_drop_legacy_role.sql',     // contract: dropped it
+  ]);
+  const dir = path.join(ROOT, 'modules', 'platform-identity', 'migrations');
+  const offenders = [];
+  for (const f of fs.readdirSync(dir)) {
+    if (!f.endsWith('.sql') || OWNS_ITS_LIFECYCLE.has(f)) continue;
+    const code = lint.stripSqlComments(fs.readFileSync(path.join(dir, f), 'utf8'));
+    if (/project_memberships/.test(code) && /\brole\b/.test(code)) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these migrations touch project_memberships and still name the dropped column: ${offenders.join(', ')}`);
+});
 
 test('core_240: the contract phase drops the trigger, the function AND the column', () => {
   const sql = read(CONTRACT);