@bongos/core 1.19.772 → 1.19.774

package/tests/public_landing_projects.mjs

@@ -138,7 +138,8 @@ test('the delete section is served live, and never claims to erase (task 1003042
   assert.match(body, /id="mDelWhat"/, 'the teardown-vs-delete fold is served');
   assert.match(body, /does <b>not<\/b> erase the project/i,
     'the distinction survives to the wire, not just the source');
-  assert.match(body, /no permanent-delete button/i, 'the absent capability is admitted');
+  assert.match(body, /use <b>Disconnect from Bongos entirely<\/b> below/, 'the true delete is its own card (task 1003249), and the fold says where');
+  assert.match(body, /id="mDisconnect"/, 'and that card is served');
   // the confirmation asks for the project's own name — the heaviest gate on the page
   assert.match(body, /Type the project’s name to confirm/, 'the typed confirmation is served');
   assert.match(body, /data-del-yes disabled/, 'and the act starts unreachable');
@@ -146,8 +147,8 @@ test('the delete section is served live, and never claims to erase (task 1003042
 
 test('the served teardown copy no longer claims the address goes quiet (task 1003042)', async () => {
   const { body } = await request('/projects', 'game.test.local');
-  // teardown has no DNS or Caddy leg: the hostname keeps resolving and 502s, so
-  // this sentence was false on the wire. Task 1002897 owns actually releasing it.
+  // teardown parks the hostname and removes its Caddy block (task 1002897) but
+  // keeps the address for a revive, so "reserved" stays and "goes quiet" never did.
   assert.doesNotMatch(body, /the address stops answering/,
     'no served copy may promise a silence the runner does not deliver');
   assert.match(body, /stays reserved for this project/,

package/tests/render_prefs.mjs

@@ -118,5 +118,157 @@ t('describeForApi reflects an explicit OFF override', () => {
   assert.equal(d.override, false);
 });
 
+// ---- the card-richness ladder (task 1002518) --------------------------------
+// The boolean became four rungs, and the rung a builder gets with no override is
+// DERIVED from their interaction profile. These pin both halves, plus the
+// compatibility surface every pinned CLI still reads.
+
+console.log('\nthe ladder:');
+
+t('LEVELS is ordered least → most rich, and rank follows the order', () => {
+  assert.deepEqual(r.LEVELS, ['minimal', 'text', 'standard', 'rich']);
+  assert.ok(r.levelRank('minimal') < r.levelRank('text'));
+  assert.ok(r.levelRank('text') < r.levelRank('standard'));
+  assert.ok(r.levelRank('standard') < r.levelRank('rich'));
+});
+
+t('the predicates say what each rung draws', () => {
+  // minimal: nothing but the confirmation line.
+  assert.equal(r.showsCard('minimal'), false);
+  assert.equal(r.showsWidget('minimal'), false);
+  // text: the monospace card, no HTML.
+  assert.equal(r.showsCard('text'), true);
+  assert.equal(r.showsWidget('text'), false);
+  // standard: the widget, summary folded.
+  assert.equal(r.showsWidget('standard'), true);
+  assert.equal(r.widgetExpanded('standard'), false);
+  // rich: the widget, summary open.
+  assert.equal(r.showsWidget('rich'), true);
+  assert.equal(r.widgetExpanded('rich'), true);
+});
+
+t('cardFlags bundles the three answers a card emitter needs', () => {
+  assert.deepEqual(r.cardFlags('rich'), { level: 'rich', showCard: true, showWidget: true, expanded: true });
+  assert.deepEqual(r.cardFlags('minimal'), { level: 'minimal', showCard: false, showWidget: false, expanded: false });
+});
+
+t('an unknown level rank-resolves to standard rather than throwing', () => {
+  // Defensive: a level string from an instance ahead of this code must degrade,
+  // not crash a ship. standard is the historical default rendering.
+  assert.equal(r.levelRank('nonsense'), r.levelRank('standard'));
+});
+
+console.log('\nderivation from the interaction profile:');
+
+const withProfile = (interaction) => ({ interaction });
+
+t('the DEFAULT builder (non-technical, concise) derives the RICHEST card', () => {
+  // The point of the task: the reader who most needs explanation, and who by
+  // definition never opened Settings, must not get the terser card.
+  assert.equal(r.derivedLevel({}), 'rich');
+  assert.equal(r.derivedLevel(null), 'rich');
+  assert.equal(r.resolveLevel({}), 'rich');
+});
+
+t('technical_level is the primary axis', () => {
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'non_technical' })), 'rich');
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'mixed' })), 'standard');
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'engineer' })), 'text');
+});
+
+t('machinery:quiet drops a rung — an expert who asked for less gets terse or none', () => {
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'engineer', machinery: 'quiet' })), 'minimal');
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'non_technical', machinery: 'quiet' })), 'standard');
+});
+
+t('verbosity:detailed raises a rung', () => {
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'engineer', verbosity: 'detailed' })), 'standard');
+});
+
+t('verbosity:concise does NOT drop a rung (it is the default — see the derivation note)', () => {
+  // Taxing the default would push the accessible-by-default builder from rich
+  // down to standard, inverting the whole point of deriving from the profile.
+  assert.equal(
+    r.derivedLevel(withProfile({ technical_level: 'non_technical', verbosity: 'concise' })),
+    r.derivedLevel(withProfile({ technical_level: 'non_technical' })),
+  );
+});
+
+t('the ladder clamps at both ends', () => {
+  // non_technical (rich) + detailed would be rank 4; engineer (text) + quiet
+  // twice over would go below 0. Neither may fall off the ladder.
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'non_technical', verbosity: 'detailed' })), 'rich');
+  assert.equal(r.derivedLevel(withProfile({ technical_level: 'engineer', machinery: 'quiet', verbosity: 'concise' })), 'minimal');
+});
+
+t('derivedReason names the fields that actually moved the level', () => {
+  const plain = r.derivedReason({});
+  assert.match(plain, /technical level: non-technical/);
+  assert.ok(!/machinery/.test(plain), 'a default field is not listed as a reason');
+  const quiet = r.derivedReason(withProfile({ technical_level: 'engineer', machinery: 'quiet' }));
+  assert.match(quiet, /machinery: quiet/);
+});
+
+console.log('\noverrides beat derivation:');
+
+t('an explicit level override wins over the profile', () => {
+  const eng = { interaction: { technical_level: 'engineer' }, widgets: 'rich' };
+  assert.equal(r.derivedLevel(eng), 'text', 'the profile would have said text');
+  assert.equal(r.resolveLevel(eng), 'rich', 'the override wins');
+  assert.equal(r.overrideLevel(eng), 'rich');
+});
+
+t('clearing the override falls back to the derived level', () => {
+  const cleared = r.applyPatch({ widgets: 'minimal', interaction: { technical_level: 'mixed' } }, { widgets: null });
+  assert.ok(!('widgets' in cleared));
+  assert.equal(r.resolveLevel(cleared), 'standard', 'back to what the profile says');
+  assert.equal(r.overrideLevel(cleared), null);
+});
+
+console.log('\nlegacy boolean compatibility (a pinned CLI / an older hall build):');
+
+t('a stored legacy boolean keeps the exact card it always meant', () => {
+  assert.equal(r.overrideLevel({ widgets: true }), 'standard');
+  assert.equal(r.overrideLevel({ widgets: false }), 'text');
+  // And it still beats the profile, because it IS an explicit choice.
+  assert.equal(r.resolveLevel({ widgets: false, interaction: { technical_level: 'non_technical' } }), 'text');
+});
+
+t('validatePatch still accepts booleans, normalising them to a level on the way in', () => {
+  assert.equal(r.validatePatch({ widgets: true }).patch.widgets, 'standard');
+  assert.equal(r.validatePatch({ widgets: false }).patch.widgets, 'text');
+});
+
+t('validatePatch accepts every level and rejects a non-level string', () => {
+  for (const lvl of r.LEVELS) {
+    assert.equal(r.validatePatch({ widgets: lvl }).ok, true, `accept ${lvl}`);
+  }
+  const bad = r.validatePatch({ widgets: 'verbose' });
+  assert.equal(bad.ok, false);
+  assert.equal(bad.errors[0].error, 'invalid_value');
+});
+
+t('widgetsEnabled — the boolean every pinned CLI reads — tracks the ladder', () => {
+  assert.equal(r.widgetsEnabled({ widgets: 'minimal' }), false);
+  assert.equal(r.widgetsEnabled({ widgets: 'text' }), false);
+  assert.equal(r.widgetsEnabled({ widgets: 'standard' }), true);
+  assert.equal(r.widgetsEnabled({ widgets: 'rich' }), true);
+});
+
+t('describeForApi keeps the legacy keys AND adds the ladder', () => {
+  const d = r.describeForApi({ interaction: { technical_level: 'engineer' } });
+  // legacy half — an older CLI reads only these and is correct
+  assert.equal(d.widgets_enabled, false, 'engineer derives text, so no widget');
+  assert.equal(d.default_enabled, true);
+  assert.equal(d.override, null, 'derived, not chosen');
+  // ladder half
+  assert.equal(d.level, 'text');
+  assert.equal(d.derived_level, 'text');
+  assert.equal(d.override_level, null);
+  assert.match(d.derived_reason, /technical level: engineer/);
+  assert.deepEqual(d.levels.map((l) => l.value), r.LEVELS);
+  assert.ok(d.levels.every((l) => l.label && l.blurb), 'every rung is labelled for the UI');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/seam_wiring_guard.mjs

@@ -0,0 +1,234 @@
+// tests/seam_wiring_guard.mjs — the declared-seam-is-consumed guard (task 1003819,
+// ADR 0289; fitness Check 33, successor to abandoned task 1002464).
+//
+// The scanner is the tested surface, driven over SYNTHETIC manifests with an injected
+// `exists` — the scanScopeMapSource / scanDeterministicBody precedent. That keeps every
+// case hermetic (no tmp dirs, no fixture modules) AND lets a case prove the guard
+// actually catches a violation, which a suite that only runs it over the real tree
+// cannot: a clean tree passes whether the check works or is a stub.
+//
+// The three properties that make this guard worth having, each pinned below:
+//   1. a declared entry whose consumer's artifact is absent is REPORTED, naming the
+//      module key and the seam;
+//   2. a legitimately declarative-only entry is DISTINGUISHED from that, and a STALE
+//      exemption (the artifact exists now) is itself reported;
+//   3. the wired set is reported on the PASS path too — a guard that is silent when
+//      it passes leaves no evidence it ran.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const guard = require(path.join(ROOT, 'scripts', 'gds', 'seam-wiring-guard.js'));
+const { scanSeamWiring, SEAM_CONSUMERS, declaredEntries, entryLabel } = guard;
+
+// A synthetic module. `dir` is a bare key — the scanner only ever hands it to
+// SEAM_CONSUMERS.artifact() and to `exists`, both of which we control here.
+const mod = (key, contributes, declarativeSeams) => ({
+  key,
+  dir: `modules/${key}`,
+  manifest: { key, contributes, ...(declarativeSeams ? { declarativeSeams } : {}) },
+});
+
+// An `exists` that answers true for exactly the paths listed (forward-slashed).
+const only = (...paths) => {
+  const set = new Set(paths);
+  return (p) => set.has(String(p).split(path.sep).join('/'));
+};
+const nothingExists = () => false;
+
+// ---------------------------------------------------------------------------
+// 1. a declared seam with no consumer artifact is reported
+// ---------------------------------------------------------------------------
+
+test('reports a declared poller whose file was never shipped, naming module + seam', () => {
+  const r = scanSeamWiring([mod('dev-box', { pollers: ['ghost'] })], { exists: nothingExists });
+  assert.equal(r.ok, false);
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /module "dev-box"/);
+  assert.match(r.findings[0], /contributes\.pollers: "ghost"/);
+  assert.match(r.findings[0], /modules\/dev-box\/pollers\/ghost\.js does not exist/);
+  // and it says what to do about it — the three legitimate resolutions
+  assert.match(r.findings[0], /Ship the artifact, drop the declaration, or record it in declarativeSeams\.pollers/);
+});
+
+test('every seam kind is covered: file, per-module file, dir, and the webSurfaces object', () => {
+  const r = scanSeamWiring([
+    mod('a', { routes: ['missing'] }),
+    mod('b', { uiSections: ['sec'] }),
+    mod('c', { skills: ['sk'] }),
+    mod('d', { webSurfaces: [{ host: 'x.', dir: 'public' }] }),
+    mod('e', { migrations: true }),
+  ], { exists: nothingExists });
+  assert.equal(r.findings.length, 5, r.findings.join('\n'));
+  for (const [key, frag] of [
+    ['a', 'modules/a/routes/missing.js'],
+    ['b', 'modules/b/public/hall-widget.js'],
+    ['c', 'modules/c/skills/sk'],
+    ['d', 'modules/d/public'],
+    ['e', 'modules/e/migrations'],
+  ]) {
+    assert.ok(r.findings.some((f) => f.includes(`module "${key}"`) && f.includes(frag)),
+      `no finding for ${key} naming ${frag}:\n${r.findings.join('\n')}`);
+  }
+});
+
+test('a seam NOTHING consumes is reported on sight — the strongest form of the defect', () => {
+  // `rooms` is allowed by the manifest schema but read by no code in the tree.
+  assert.equal(SEAM_CONSUMERS.rooms.consumer, null);
+  // …and shipping the file does not help, because nothing would load it.
+  const r = scanSeamWiring([mod('game', { rooms: ['WorldRoom'] })], { exists: only('modules/game/rooms/WorldRoom.js') });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /NOTHING in the tree consumes the rooms seam at all/);
+});
+
+test('a disciplines entry absent from the registry is reported', () => {
+  const r = scanSeamWiring([mod('ui-design', { disciplines: ['nope'] })], { registryKeys: new Set(['ui']) });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /has no such entry/);
+  // a null registry leaves the seam UNCHECKED rather than failing it
+  assert.equal(scanSeamWiring([mod('ui-design', { disciplines: ['nope'] })], { registryKeys: null }).ok, true);
+});
+
+// ---------------------------------------------------------------------------
+// 2. declarative-only is distinguished, and a stale exemption is caught
+// ---------------------------------------------------------------------------
+
+test('a declarative-only entry is recorded, not reported — the load-bearing nuance', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.ok, true, r.findings.join('; '));
+  assert.deepEqual(r.declarative, [{ key: 'dev-box', seam: 'pollers', entry: 'box-lifecycle' }]);
+  assert.deepEqual(r.wired, []);
+});
+
+test('the exemption is per-ENTRY, not a blanket skip of the seam', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle', 'ghost'] }, { pollers: ['box-lifecycle'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.ok, false);
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /"ghost"/);
+  assert.deepEqual(r.declarative.map((d) => d.entry), ['box-lifecycle']);
+});
+
+test('a STALE exemption — the artifact exists now — is itself reported', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    { exists: only('modules/dev-box/pollers/box-lifecycle.js') },
+  );
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /exempts pollers "box-lifecycle" as declarative-only, but modules\/dev-box\/pollers\/box-lifecycle\.js exists/);
+  assert.match(r.findings[0], /drop the stale declarativeSeams\.pollers entry/);
+  assert.deepEqual(r.declarative, [], 'a stale exemption must not also count as declarative-only');
+});
+
+test('an exemption on one seam does not leak to another seam of the same module', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /contributes\.uiSections/);
+});
+
+test('a skill counts as wired from the module tree OR its vendor/ subdir', () => {
+  const own = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/style/SKILL.md') });
+  assert.equal(own.ok, true, own.findings.join('; '));
+  const vendored = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/vendor/style/SKILL.md') });
+  assert.equal(vendored.ok, true, vendored.findings.join('; '));
+});
+
+test('a skills/<name>/ dir with NO SKILL.md is unwired — the consumer requires the file', () => {
+  // moduleSkillSources tests `fs.existsSync(path.join(p, 'SKILL.md'))`, so a bare dir
+  // is not a skill to it. Probing the directory would call such an entry wired while
+  // the real consumer skipped it — this guard's own version of the defect it catches.
+  const r = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/style') });
+  assert.equal(r.ok, false, 'a dir without SKILL.md must not count as wired');
+  assert.match(r.findings[0], /modules\/ui-design\/skills\/style\/SKILL\.md does not exist/);
+});
+
+test('an entry that reaches outside its own module dir is reported, never probed', () => {
+  // Only routes/pollers/rooms/uiSections/skills are constrained to non-empty strings
+  // by the schema, so an entry could carry '..'. The probe is an existence test over
+  // repo-committed content, but a declaration reaching out of its module is a finding.
+  let probed = 0;
+  const r = scanSeamWiring([mod('a', { routes: ['../../etc/passwd'] })], { exists: () => { probed += 1; return true; } });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /outside the module's own directory/);
+  assert.equal(probed, 0, 'the escaping path must not be probed at all');
+});
+
+// ---------------------------------------------------------------------------
+// 3. the wired set is reported on the PASS path too
+// ---------------------------------------------------------------------------
+
+test('a fully wired module reports its wired entries, so a pass is evidence the guard ran', () => {
+  const r = scanSeamWiring(
+    [mod('economy', { routes: ['cost', 'credits'], migrations: true })],
+    { exists: only('modules/economy/routes/cost.js', 'modules/economy/routes/credits.js', 'modules/economy/migrations') },
+  );
+  assert.equal(r.ok, true, r.findings.join('; '));
+  assert.equal(r.wired.length, 3);
+  assert.deepEqual(r.wired.map((w) => w.entry).sort(), ['cost', 'credits', 'migrations/']);
+  for (const w of r.wired) assert.ok(w.via, 'each wired entry names the consumer that wires it');
+});
+
+test('an empty array and an absent contributes declare nothing at all', () => {
+  const r = scanSeamWiring([mod('discord', { uiSections: [] }), mod('quiet', {})], { exists: nothingExists });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.wired, []);
+  assert.deepEqual(r.declarative, []);
+});
+
+test('an unknown contributes key is validateManifest\'s error, not this guard\'s', () => {
+  const r = scanSeamWiring([mod('x', { pollerz: ['a'] })], { exists: nothingExists });
+  assert.equal(r.ok, true, 'the guard must not double-report a shape error');
+});
+
+test('the guard and the schema share ONE enumerator + labeller, not two copies', () => {
+  // The exemption cross-check (validateManifest) and the wiring check (this guard)
+  // must agree on what a contributes block declares and what each entry is called.
+  // Two copies would drift, and the drift would land on whether an exemption is honoured.
+  const schema = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
+  assert.equal(declaredEntries, schema.declaredEntries);
+  assert.equal(entryLabel, schema.entryLabel);
+});
+
+test('declaredEntries + entryLabel: migrations true/array, and the two webSurface shapes', () => {
+  assert.deepEqual(declaredEntries('migrations', true), [true]);
+  assert.deepEqual(declaredEntries('migrations', ['001_x.sql']), ['001_x.sql']);
+  assert.deepEqual(declaredEntries('migrations', false), []);
+  assert.deepEqual(declaredEntries('routes', undefined), []);
+  assert.equal(entryLabel('migrations', true), 'migrations/');
+  assert.equal(entryLabel('webSurfaces', { host: 'status.', dir: 'public' }), 'status.(public)');
+  assert.equal(entryLabel('webSurfaces', { apexRoot: true, dir: 'public' }), 'apexRoot:public');
+});
+
+// ---------------------------------------------------------------------------
+// the live tree — the regression the guard exists to hold
+// ---------------------------------------------------------------------------
+
+test('the real module set is clean: every declared seam is wired or recorded declarative-only', () => {
+  const r = guard.checkSeamWiring();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+  // the pass note carries the evidence, not just "ok"
+  assert.match(r.note, /WIRED across \d+ seam\(s\)/);
+  assert.match(r.note, /recorded declarative-only/);
+});
+
+test('every seam the manifest schema allows has an entry in SEAM_CONSUMERS', () => {
+  // Otherwise a new contributes key would be silently unchecked — the same gap in a
+  // new place. The schema's list is the source; this guard must span all of it.
+  const { ALLOWED_CONTRIBUTES } = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
+  const missing = ALLOWED_CONTRIBUTES.filter((k) => !(k in SEAM_CONSUMERS));
+  assert.deepEqual(missing, [], `SEAM_CONSUMERS has no entry for: ${missing.join(', ')}`);
+});

package/tests/ship_card.mjs

@@ -291,7 +291,73 @@ test('emitCard with widgetsEnabled:false: monospace only, no HTML, off-marker',
   assert.equal(file, null, 'no HTML file written when widgets are off');
   assert.match(out, /Example World · task #1266/); // the monospace card still printed
   assert.ok(!out.includes('[otb-card-html]'), 'no [otb-card-html] marker emitted');
-  assert.match(out, /widgets are off/); // off-marker tells the skill not to call show_widget
+  assert.match(out, /rich cards are off/); // off-marker tells the skill not to call show_widget
+});
+
+// ---- the card-richness ladder (task 1002518) --------------------------------
+// emitCard receives the resolved rung as FLAGS, never as a level string: the
+// ladder lives in modules/builder-settings/render-prefs.js and a module may not
+// require a sibling module (ADR 0083). These pin what each rung draws.
+
+test('flags.expanded opens the widget summary; without it the summary stays folded', () => {
+  const model = card.buildCardModel(shippedInput);
+  const folded = card.renderCardHtml(model);
+  const open = card.renderCardHtml(model, { expanded: true });
+  // The summary body is the LAST div; folded hides it, expanded shows it.
+  assert.match(folded, /<div style="display:none;margin-top:0\.6rem/, 'default card folds its summary');
+  assert.match(open, /<div style="display:block;margin-top:0\.6rem/, 'expanded card opens its summary');
+  // The toggle still works either way — expanded only picks the starting state.
+  assert.match(open, /Toggle task summary/);
+  assert.match(open, /rotate\(90deg\)/, 'chevron points down when it starts open');
+});
+
+test('minimal rung: no monospace card at all, but the confirmation line survives', () => {
+  const lines = [];
+  const file = card.emitCard(card.buildCardModel(shippedInput), 99997, {
+    log: (s) => lines.push(String(s)),
+    flags: { showCard: false, showWidget: false, expanded: false },
+  });
+  const out = lines.join('\n');
+  assert.equal(file, null, 'no HTML written at the minimal rung');
+  assert.ok(!out.includes('Example World · task #1266'), 'the monospace card is NOT printed');
+  assert.ok(!out.includes('[otb-card-html]'), 'no widget marker emitted');
+  // task 1001730's floor holds at every rung — this is the whole reason the
+  // confirm line is emitted before the card branches.
+  assert.match(out, /\[otb-confirm\] shipped: task 1266/, 'the guaranteed line still prints');
+  assert.match(out, /minimal cards/, 'the directive tells the skill to relay only that line');
+});
+
+test('rich rung: the widget is written AND its summary starts open', () => {
+  const lines = [];
+  const file = card.emitCard(card.buildCardModel(shippedInput), 99996, {
+    log: (s) => lines.push(String(s)),
+    flags: { showCard: true, showWidget: true, expanded: true },
+  });
+  assert.ok(file, 'HTML file written at the rich rung');
+  const html = fs.readFileSync(file, 'utf8');
+  assert.match(html, /<div style="display:block;margin-top:0\.6rem/, 'summary open on arrival');
+  const out = lines.join('\n');
+  assert.match(out, /Example World · task #1266/, 'monospace card still printed');
+  assert.match(out, /\[otb-card-html\]/, 'widget marker emitted');
+  fs.unlinkSync(file);
+});
+
+test('flags absent falls back to the historical boolean meaning', () => {
+  // A caller that has not learned the ladder yet (an older script, a test) keeps
+  // exactly the behaviour it had: monospace always, widget iff true, never open.
+  for (const widgetsEnabled of [true, false]) {
+    const lines = [];
+    const file = card.emitCard(card.buildCardModel(shippedInput), 99995, {
+      log: (s) => lines.push(String(s)), widgetsEnabled,
+    });
+    const out = lines.join('\n');
+    assert.match(out, /Example World · task #1266/, `boolean ${widgetsEnabled} still prints the monospace card`);
+    assert.equal(!!file, widgetsEnabled, `boolean ${widgetsEnabled} decides the widget`);
+    if (file) {
+      assert.match(fs.readFileSync(file, 'utf8'), /<div style="display:none;margin-top:0\.6rem/, 'never expanded via the boolean');
+      fs.unlinkSync(file);
+    }
+  }
 });
 
 // ---- lifecycle trail: full journey on every card (tasks 1487 + 1489) ----

package/tests/ship_resume.mjs

@@ -133,25 +133,88 @@ test('completed + owner with low rank still resumes (ownership, not rank)', () =
 // 'completed' task into the re-grade before reading a flag. The manual-confirm
 // path a no-artifact task needs is unreachable from 'completed' any other way.
 
-test('empty diff + --allow-empty → confirm instead of bailing (the 1003146 shape)', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--allow-empty'] }), true);
-});
-
-test('empty diff + --skip-grade → confirm (the other documented no-artifact flag)', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--skip-grade'] }), true);
+test('empty diff + --allow-empty + a CLEAN tree → confirm instead of bailing (the 1003146 shape)', () => {
+  const v = shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--allow-empty'] });
+  assert.equal(v.confirm, true);
+  assert.equal(v.reason, 'allow-empty');
 });
 
 test('a REAL diff + --allow-empty still grades — the flag is not a grader bypass', () => {
   // The hole this guard exists to avoid: if a declaration alone were enough, a task
   // whose grade FAILED could dodge the verdict by re-running with --allow-empty.
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, args: ['1003146', '--allow-empty'] }), false);
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, args: ['1003146', '--skip-grade'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, porcelain: '', args: ['1003146', '--allow-empty'] }).confirm, false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, porcelain: '', args: ['1003146', '--allow-empty'] }).reason, 'has-diff');
 });
 
 test('empty diff with NO flag keeps dead-ending — uncommitted work must not "ship"', () => {
   // The overwhelmingly common cause of an empty diff is forgetting to commit.
   // Confirming that silently would report success having shipped nothing.
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146'] }).confirm, false);
+});
+
+// ---- task 1003944: the same guard had re-opened the task-1363 phantom ship ----
+// The first cut asked only "is the diff empty?" and "was a flag passed?", which is
+// strictly WEAKER than the decision the FIRST-ship path makes at the same moment.
+// Two consequences, both reachable in one command, both fixed here.
+
+test('an UNTRACKED deliverable is refused even under --allow-empty (task 1363)', () => {
+  // The whole point of task 1363: a new file left untracked is invisible to
+  // preflight (trackedDirty ignores untracked), so this decision was the ONLY thing
+  // standing between "you forgot to commit" and a row marked shipped with HEAD
+  // never moved. --allow-empty asserts there is no artifact; the tree proves there
+  // is one, and the tree wins.
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: '?? docs/the-deliverable.md', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false, 'an untracked deliverable must never manual-confirm');
+  assert.equal(v.reason, 'uncommitted-work');
+  assert.deepEqual(v.uncommitted, ['docs/the-deliverable.md'], 'and the builder is told WHICH file');
+});
+
+test('a tracked-but-uncommitted edit is refused under --allow-empty too', () => {
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: ' M scripts/gds/ship.js', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false);
+  assert.equal(v.reason, 'uncommitted-work');
+});
+
+test('--skip-grade is NOT an artifact declaration — it declares nothing about artifacts', () => {
+  // ship.js documents it as a grader-outage override, "NOT a routine flag", and
+  // task 1365 removed it from the first-ship empty-diff decision for exactly this
+  // reason. Accepting it here re-opened the half of task 1363 that fix had closed.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--skip-grade'] }).confirm,
+    false, '--skip-grade must not confirm an empty ship on its own');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: '', args: ['1003146', '--skip-grade', '--allow-empty'] }).confirm,
+    true, 'but it must not BLOCK a properly declared one either');
+});
+
+test('the refusal names the PATH, not the porcelain status codes', () => {
+  // A rename line is "R  old -> new" and a quoted path is wrapped in "…". The
+  // builder has to be told which file to commit, so the reported name must be the
+  // path. (.gitignored files never reach here at all: `git status --porcelain`
+  // omits them unless --ignored is passed, which the call site does not pass — the
+  // call-site test below pins the exact command.)
+  const v = shouldConfirmWithoutGrade({
+    committedFileCount: 0, porcelain: 'R  docs/old.md -> docs/new.md\n?? "docs/a b.md"', args: ['1003146', '--allow-empty'],
+  });
+  assert.equal(v.confirm, false);
+  assert.deepEqual(v.uncommitted, ['docs/new.md', 'docs/a b.md']);
+});
+
+test('the re-grade decision and the FIRST-ship decision agree on the same tree', () => {
+  // The defect was a second, weaker copy of one rule. This asserts they are the
+  // same rule: for every tree, the re-grade verdict must equal what classifyEmptyShip
+  // — the function the first ship calls — says about it. A re-divergence reds here.
+  const { classifyEmptyShip } = require('../modules/lifecycle/ship-preflight');
+  for (const porcelain of ['', '?? docs/new.md', ' M scripts/gds/ship.js', '!! node_modules/x', 'A  a.js\n?? b.js']) {
+    for (const args of [['--allow-empty'], []]) {
+      const first = classifyEmptyShip(porcelain, { allowEmpty: args.includes('--allow-empty') });
+      const resume = shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain, args });
+      assert.equal(resume.confirm, !first.refuse, `divergence on ${JSON.stringify(porcelain)} ${JSON.stringify(args)}`);
+      assert.equal(resume.reason, first.reason, `reason divergence on ${JSON.stringify(porcelain)}`);
+    }
+  }
 });
 
 test('the empty-diff guard is actually WIRED to the decision, not just exporting it', () => {
@@ -171,10 +234,21 @@ test('the empty-diff guard is actually WIRED to the decision, not just exporting
     'and reaching it must land on the manual-confirm route a no-artifact task needs');
 });
 
+test('the call site MEASURES the working tree — the truth table alone cannot prove this', () => {
+  // task 1003944, and the reason this assertion is separate from the wiring test
+  // above: `porcelain` DEFAULTS to '' — a clean tree. Drop the argument at the call
+  // site and every truth-table case above stays green while the real ship goes back
+  // to confirming untracked work. The evidence has to be shown to be COLLECTED.
+  const src = shipCliSource();
+  assert.match(src, /shouldConfirmWithoutGrade\(\{[^}]*porcelain:\s*gitOk\('git status --porcelain'\)/,
+    'the re-grade guard must pass the REAL `git status --porcelain`, not fall back to the clean-tree default');
+});
+
 test('shouldConfirmWithoutGrade: defaults and odd inputs never throw', () => {
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }), false, 'no args → no declaration');
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }), true, 'a numeric string still counts as empty');
-  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }), false, 'an unknown count is not an empty one');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }).confirm, false, 'no args → no declaration');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }).confirm, true, 'a numeric string still counts as empty');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }).confirm, false, 'an unknown count is not an empty one');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, porcelain: null, args: ['--allow-empty'] }).confirm, true, 'a null porcelain reads as a clean tree');
 });
 
 console.log('');