@bongos/core 1.19.790 → 1.19.791

package/tests/accessibility_replay.mjs

@@ -0,0 +1,201 @@
+// tests/accessibility_replay.mjs
+//
+// The two-profile replay regression (task 1002517; clauses 5 and 8 of criterion
+// `accessibility-fluency-profile`) — the proof the criterion named for itself
+// and that had never been run.
+//
+// This is NOT a second copy of tests/session_accessibility.mjs. That file pins
+// the scorer's arithmetic against fixtures it builds line by line. This one runs
+// a fixed set of eight beginner questions through two real answer registers and
+// asserts what the criterion actually claims: accessible prose clears a floor,
+// an expert's prose is not scored for being an expert's prose, and the two
+// verdicts come from the same corpus — so neither is a tautology.
+//
+// The assertion that keeps the rest honest is DISCRIMINATION (leg 3). A scorer
+// that had gone blind — three detectors quietly matching nothing — produces a
+// perfect 10 on the non-technical run and passes leg 1 looking exactly like a
+// working one. Leg 3 reads the same engineer prose as a newcomer would and
+// requires every detector to register hits and the score to fall through the
+// floor. Nothing else here can pass while the detectors are dead.
+//
+// Run:  node tests/accessibility_replay.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const H = require('../scripts/gds/accessibility-replay.js');
+const acc = require('../modules/sessions/accessibility.js');
+
+const corpus = H.loadCorpus();
+const NEWCOMER = corpus.runs.non_technical.profile;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const signalsOf = (r) => Object.fromEntries(r.result.signals.map((s) => [s.type, s]));
+
+// ---- the floor is the scorer's own line, not a second number ---------------
+
+test('FLOOR is bandFor()\'s workable boundary, so retuning the bands cannot move it silently', () => {
+  assert.equal(H.bandFor(H.FLOOR), 'workable', 'FLOOR sits exactly on the workable boundary');
+  assert.equal(H.bandFor(H.FLOOR - 0.1), 'dense', 'a tenth below the floor is already the dense band');
+  assert.equal(corpus.floor, H.FLOOR, 'the corpus records the same floor the harness enforces');
+});
+
+// ---- the corpus is a fixed set, and both runs answer all of it -------------
+
+test('the prompt set is fixed, non-trivial, and answered in full by both runs', () => {
+  assert.ok(corpus.prompts.length >= 8, 'at least eight beginner prompts');
+  const ids = corpus.prompts.map((p) => p.id);
+  assert.equal(new Set(ids).size, ids.length, 'prompt ids are unique');
+  for (const runName of ['non_technical', 'engineer']) {
+    const run = corpus.runs[runName];
+    for (const id of ids) {
+      const turns = run.replies[id];
+      assert.ok(Array.isArray(turns) && turns.length > 0, `${runName} answers ${id}`);
+      for (const t of turns) assert.ok(typeof t === 'string' && t.trim(), `${runName}/${id} turn is prose`);
+    }
+    for (const [field, value] of Object.entries(run.profile)) {
+      assert.ok(acc.PROFILE_VALUES[field]?.includes(value), `${runName} profile ${field}=${value} is a real value`);
+    }
+  }
+});
+
+// ---- leg 1: the dimension recognises accessible prose ----------------------
+
+test('leg 1 — the non-technical run clears the floor under the non-technical profile', () => {
+  const r = H.replay(corpus, 'non_technical');
+  assert.ok(r.result.score != null, 'the non-technical run is scored, not waived away');
+  assert.ok(
+    r.result.score >= H.FLOOR,
+    `non-technical run scored ${r.result.score}, floor is ${H.FLOOR}`
+  );
+  assert.equal(r.result.confidence, 'normal', 'the sample is big enough for the score to stand behind');
+});
+
+// ---- leg 2: an expert's prose is not scored for being an expert's prose ----
+
+test('leg 2 — the engineer run is not scored at all under the engineer profile', () => {
+  const r = H.replay(corpus, 'engineer');
+  assert.equal(r.result.score, null, 'an all-waived session scores null, never a number');
+  assert.equal(r.result.band, 'n/a');
+  assert.equal(r.result.signals.length, 3);
+  for (const s of r.result.signals) {
+    assert.equal(s.waived, true, `${s.type} is waived for this profile`);
+    assert.ok(/technical_level|toolchain_familiarity/.test(s.reason), `${s.type} names the setting that waived it`);
+  }
+  assert.equal(r.result.confidence, 'normal', 'the prose was read — the null is a waiver, not an empty sample');
+});
+
+test('leg 2 holds when the same expert answers even more briefly', () => {
+  const full = H.replay(corpus, 'engineer');
+  const terse = H.replay(corpus, 'engineer', { variant: 'terse' });
+  assert.ok(terse.result.sampled_chars < full.result.sampled_chars, 'the terse variant really is shorter');
+  assert.equal(terse.result.score, null, 'still nothing to regress');
+});
+
+// ---- leg 3: the same prose, read as a newcomer would read it ---------------
+
+test('leg 3 — the SAME engineer prose falls through the floor under the non-technical profile', () => {
+  const r = H.replay(corpus, 'engineer', { profile: NEWCOMER });
+  assert.ok(r.result.score != null, 'nothing is waived for a newcomer');
+  assert.ok(
+    r.result.score < H.FLOOR,
+    `engineer prose read as a newcomer scored ${r.result.score}, which should be under ${H.FLOOR}`
+  );
+});
+
+test('leg 3 — every detector registers hits, so a scorer that went blind cannot pass', () => {
+  const s = signalsOf(H.replay(corpus, 'engineer', { profile: NEWCOMER }));
+  for (const type of Object.keys(acc.SIGNAL_SPEC)) {
+    assert.ok(s[type], `${type} was scored`);
+    assert.ok(s[type].count > 0, `${type} found something in the engineer prose (found ${s[type].count})`);
+    assert.ok(s[type].evidence, `${type} can name what it found`);
+  }
+});
+
+// ---- the perfect run is forgiveness, not avoidance -------------------------
+
+test('the non-technical run scores well WITH a jargon term and implementation framing in it, not by dodging them', () => {
+  const prose = Object.values(corpus.runs.non_technical.replies).flat().join('\n');
+  const present = acc.JARGON_TERMS.filter((t) => new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(prose));
+  assert.ok(present.length > 0, 'the accessible prose does use at least one term from the jargon list');
+  assert.ok(/\barchitecture\b/i.test(prose), 'and frames something in architecture terms at least once');
+
+  const s = signalsOf(H.replay(corpus, 'non_technical'));
+  assert.equal(s.unexplained_jargon.count, 0, `"${present.join('", "')}" is used and DEFINED, so it is not a finding`);
+  assert.equal(s.implementation_over_outcome.count, 0, 'the architecture turn also names the cost, so it is not a finding');
+});
+
+// ---- leg 4: the metric reads density, not volume --------------------------
+
+test('leg 4 — saying the same thing twice doubles the counts and leaves every rate, and the score, identical', () => {
+  const once = H.replay(corpus, 'engineer', { profile: NEWCOMER });
+  const twice = H.replay(corpus, 'engineer', { profile: NEWCOMER, variant: 'doubled' });
+  assert.equal(twice.result.sampled_chars, once.result.sampled_chars * 2, 'twice the prose');
+
+  const a = signalsOf(once);
+  const b = signalsOf(twice);
+  for (const type of Object.keys(acc.SIGNAL_SPEC)) {
+    assert.equal(b[type].count, a[type].count * 2, `${type} finds twice as much in twice the prose`);
+    assert.equal(b[type].rate, a[type].rate, `${type} rate is unchanged — the metric reads density, not volume`);
+  }
+  assert.equal(twice.result.score, once.result.score, 'so the score does not move with length');
+});
+
+test('answering more briefly never costs points', () => {
+  for (const runName of ['non_technical', 'engineer']) {
+    const full = H.replay(corpus, runName);
+    const terse = H.replay(corpus, runName, { variant: 'terse' });
+    assert.ok(terse.result.sampled_chars < full.result.sampled_chars, `${runName} terse variant is shorter`);
+    if (full.result.score == null) {
+      assert.equal(terse.result.score, null, `${runName} stays unscored`);
+      continue;
+    }
+    assert.ok(
+      terse.result.score >= full.result.score,
+      `${runName} terse scored ${terse.result.score} against ${full.result.score} full — brevity must not cost`
+    );
+  }
+});
+
+// ---- the two waivers are independent settings ------------------------------
+
+test('an engineer who is new to the terminal still gets the click-path signal', () => {
+  const r = H.replay(corpus, 'engineer', { profile: H.ENGINEER_NEW_TO_TOOLCHAIN });
+  const s = signalsOf(r);
+  assert.equal(r.result.signals.filter((x) => x.waived).length, 2, 'technical_level waives two, not three');
+  assert.equal(s.terminal_where_ui_exists.waived, false, 'the click-path signal is waived by TOOLCHAIN familiarity, not by technical level');
+  assert.ok(s.terminal_where_ui_exists.count > 0, 'and it still finds the commands handed over');
+  assert.ok(r.result.score != null, 'so this profile still gets a number');
+});
+
+// ---- the harness is runnable, which is half of what the task asked for -----
+
+test('the report renders and names every run', () => {
+  const out = H.formatReport(corpus);
+  assert.ok(out.includes(`floor ${H.FLOOR.toFixed(1)}`), 'the report states the floor it enforces');
+  assert.ok(out.includes('non-technical profile'), 'and both profiles appear');
+  assert.ok(out.includes('engineer profile'));
+
+  let json = '';
+  assert.equal(H.main(['--json'], (s) => { json += s; }), 0, 'the JSON mode exits clean');
+  const parsed = JSON.parse(json);
+  assert.equal(parsed.floor, H.FLOOR, 'and carries the floor a caller would check against');
+});
+
+console.log('');
+console.log(`Accessibility two-profile replay (clauses 5 + 8): ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/fixtures/accessibility-replay.json

@@ -0,0 +1,93 @@
+{
+  "_comment": "The fixed beginner-prompt set for the accessibility replay regression (task 1002517, clauses 5 and 8 of criterion accessibility-fluency-profile). EIGHT prompts a newcomer to this instance actually asks; each one is the documented trigger of a real surface, so the click-paths named in the non-technical replies are paths that EXIST (Settings -> API keys, Settings -> Session, Settings -> Interaction, the hall task list, the hall blockers page, the hall leaderboard, the hall Deploy page). Prompt 'make-it-live' is the owner's own words, verbatim, 2026-08-22 (task 1003159). Each prompt carries TWO answer runs: the same question answered in the register each profile asks for. The runs are the CONTROLLED variable and the prompt set is fixed - that is what makes this a replay rather than a fixture parade. Nothing here is tuned to a target score: the replies are written in each register and the harness measures what falls out, so a detector that goes blind moves these numbers.",
+  "floor": 6.0,
+  "_floor_comment": "6.0 is not a new number. It is bandFor()'s 'workable' boundary in modules/sessions/accessibility.js - the point the scorer itself calls the difference between prose a newcomer can work with and prose that is merely dense. accessibility_replay.mjs asserts the two stay tied, so retuning the bands cannot silently move the floor.",
+  "prompts": [
+    { "id": "what-to-work-on", "prompt": "What can I work on?" },
+    { "id": "make-it-live", "prompt": "I don't think I can make anything live." },
+    { "id": "art-key", "prompt": "My image generation stopped working." },
+    { "id": "session-expired", "prompt": "It says my session expired." },
+    { "id": "how-you-talk", "prompt": "Can you stop using so much jargon with me?" },
+    { "id": "credits", "prompt": "How do credits work here?" },
+    { "id": "stuck", "prompt": "What's stuck waiting on me?" },
+    { "id": "why-slow", "prompt": "Why is that page so slow?" }
+  ],
+  "runs": {
+    "non_technical": {
+      "_comment": "The register the non-technical profile asks for: lead with the answer, name the click-path before the terminal, define a term the first time it is needed, and frame the trade-off as cost, time and what the reader will see. Two turns deliberately exercise the scorer's FORGIVING paths rather than dodging them - 'why-slow' turn 1 uses the word migration and defines it in the same breath, and turn 2 names the architecture AND what it costs - because a run that scores well only by avoiding every trigger proves nothing about the detectors.",
+      "profile": { "technical_level": "non_technical", "toolchain_familiarity": "new" },
+      "replies": {
+        "what-to-work-on": [
+          "Four jobs are open to you right now. They are on the hall task list, newest first, and each row shows what it pays and roughly how long it takes.",
+          "The second one is the quickest - about twenty minutes, and it pays thirty credits. Tell me its number and I will take it on for you."
+        ],
+        "make-it-live": [
+          "You can do this yourself now, and it is two clicks. In the hall, open Deploy: the page shows the version your site is actually serving and the newer one it would move to.",
+          "The first click previews the move and the second makes it. If the new version does not answer within a minute it puts the old one back on its own, so a bad release cannot leave your site down. It costs nothing and takes about two minutes."
+        ],
+        "art-key": [
+          "Your free art coverage has ended, so pictures now come out of an art key of your own - think of a key as a password that lets us make images on your account, and you pay only for what you make.",
+          "Add it in Settings, under API keys. Do not paste it to me in chat; the Settings page is the only place it should ever go. Most people spend a few dollars per month on this."
+        ],
+        "session-expired": [
+          "That message means your sign-in has timed out. Nothing is lost, and it happens every few weeks on purpose.",
+          "Open Settings, then Session, and choose Re-issue. That hands you a fresh code and I take it from there. It takes under a minute."
+        ],
+        "how-you-talk": [
+          "Yes - and it is a setting, so you will not have to keep asking. Open Settings, then Interaction, and set your technical level to non-technical.",
+          "Every session after that starts already knowing to define a term the first time it comes up, and to talk in cost, time and what you will see on screen. You will notice the difference in the very next reply."
+        ],
+        "credits": [
+          "Credits are the record of what building here actually cost. When a piece of work ships you earn what the session really cost plus twenty per cent, and one credit is one dollar.",
+          "The figure on a task row is only a guide - you are paid on the real cost, never the estimate. Your running total sits on the hall leaderboard."
+        ],
+        "stuck": [
+          "Four things are waiting on you rather than on me. Two need a yes or no and two need a number I cannot guess for you.",
+          "They are all on the hall blockers page, oldest first. The one at the top has been sitting eleven days and is holding up two other jobs, so it is the one worth five minutes."
+        ],
+        "why-slow": [
+          "The page re-reads the whole list every time someone opens it. The fix is a migration - that is a one-off change to the way the information is kept - and it would take about an hour.",
+          "The architecture underneath is fine; the cost is that repeated reading. After the change the page should open in under a second instead of four."
+        ]
+      }
+    },
+    "engineer": {
+      "_comment": "The same eight questions answered the way an engineer profile asks to be answered: terse, command-first, and in the vocabulary of the trade with nothing defined. This run is DELIBERATELY dense in all three signals - that is the point. Under the engineer profile it must not be scored for any of it; under the non-technical profile the very same prose must fall through the floor. One run, two profiles, opposite verdicts is what proves the dimension is profile-relative rather than a taste test.",
+      "profile": { "technical_level": "engineer", "toolchain_familiarity": "comfortable" },
+      "replies": {
+        "what-to-work-on": [
+          "Four ready. Run `node scripts/gds/start.js`, then claim a task by id.",
+          "Second row is a refactor behind the module boundary. The claim is idempotent, so re-running it is a no-op."
+        ],
+        "make-it-live": [
+          "Pin move is gate 3. `bongos upgrade --registry --to <ver> --commit-pin` on the control plane, or the Deploy page enqueues the same intent.",
+          "The control flow is enqueue, drain, health-gate, rollback. SIGTERM on a failed probe and the symlink goes back."
+        ],
+        "art-key": [
+          "Art key is unset. Run `node scripts/gds/api.js` against the settings route, or set it in Settings - either path ends up in the same env file.",
+          "The upstream call is async and the error surfaces on stderr, not in the hall."
+        ],
+        "session-expired": [
+          "Session token expired. Run `bongos auth --reissue`.",
+          "The JWT is short-lived by design and the refresh is idempotent, so a double call is harmless."
+        ],
+        "how-you-talk": [
+          "That is the interaction profile. Run `node scripts/gds/api.js PATCH /settings`, or set it in Settings.",
+          "It is injected per session by the Conductor hook and never memoized, so the change takes on the next turn."
+        ],
+        "credits": [
+          "Cost-plus. Run `node scripts/gds/api.js GET /builders/me` for your balance, or read the leaderboard.",
+          "The write is an upsert keyed on the session, so a replayed ship cannot double-pay."
+        ],
+        "stuck": [
+          "Four open blockers. Run `node scripts/gds/blocker-review.js` to walk them.",
+          "Resolving one will upsert the linked rows to ready inside the same transaction."
+        ],
+        "why-slow": [
+          "N+1 on the list read.",
+          "The ORM will hydrate each row separately. Fold it into one query against the schema with a jsonb aggregate."
+        ]
+      }
+    }
+  }
+}

package/tests/hall_studio_world.mjs

@@ -106,15 +106,17 @@ test('the verdict is offered only to a viewer the routes will accept', () => {
   assert.match(JS, /studio-verdict__sealed/, 'a viewer below the floor gets a sentence, not three dead buttons');
 });
 
-test('the review card shows the reviewed work\'s picture, through the kit', () => {
-  // "the picture is the card" — and drawn by the kit's ONE full-size renderer
-  // rather than a third hand-rolled <figure> (the task's own instruction).
-  assert.match(JS, /kit\.taskVisualFigureHtml\(/, 'the plate comes from the kit renderer');
+test('the review card shows the reviewed work\'s picture, through the shared renderer', () => {
+  // "the picture is the card" — and drawn by the ONE full-size renderer rather
+  // than a hand-rolled <figure>. That renderer moved out of hall-kit.js into
+  // hall-visual.js in task 1003835, so the Studio now reaches for OTBVisual; the
+  // rule this pins is unchanged, only where the one copy lives.
+  assert.match(JS, /vis\.taskVisualFigureHtml\(/, 'the plate comes from the shared renderer');
   assert.ok(!/<figure/.test(JS), 'studio.js builds no <figure> of its own');
-  assert.match(HTML, /hall-kit\.js/, 'and the page loads the kit that owns it');
+  assert.match(HTML, /hall-visual\.js/, 'and the page loads the file that owns it');
   // The degrade: a review with no visual (or one that could not be read) draws
   // nothing at all rather than an empty frame, so it still reads as a review.
-  assert.match(JS, /if \(!p\.shipped \|\| !kit/, 'no reviewed task, no kit → no plate');
+  assert.match(JS, /if \(!p\.shipped \|\| !vis/, 'no reviewed task, no renderer → no plate');
   // The reviewed task is read for the card in focus, once — not 50 times up front.
   assert.match(JS, /p\.hydrated = true;/, 'the read is made once per review');
   assert.match(JS, /\$\{API\}\/tasks\/\$\{encodeURIComponent\(p\.shippedId\)\}/, 'and it reads the SHIPPED task the review names');
@@ -204,7 +206,8 @@ test('the accent is spent only where the rule allows', () => {
 });
 
 // ---------------------------------------------------------------------------
-// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js beside it
+// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js and
+// hall-visual.js beside it
 // (the bootShell pattern below, pointed at the page script). The static-source
 // assertions above pin the wiring; these render the card and read what it
 // actually says, which is the only way to pin a DEGRADE — "no picture" and
@@ -215,11 +218,15 @@ test('the accent is spent only where the rule allows', () => {
 // NEW_TASK_ID so the "needs work" pair can be followed to its merge.
 const NEW_TASK_ID = '2001';
 async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags = null, onWrite = null } = {}) {
-  // The REAL kit, not a stub — the plate's URL guard and escaping are its code,
-  // and a stub here would make the degrade tests below pass for the wrong reason
-  // (no kit also means no plate). It is node-require-safe by its own contract.
+  // The REAL modules, not stubs — the plate's URL guard and escaping are their
+  // code, and a stub here would make the degrade tests below pass for the wrong
+  // reason (no renderer also means no plate). Both are node-require-safe by their
+  // own contract. hall-visual.js carries the renderer since task 1003835; the kit
+  // is still loaded because the page still uses the rest of it.
   const kit = (await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`)).default;
-  assert.equal(typeof kit.taskVisualFigureHtml, 'function', 'the real kit loaded');
+  const vis = (await import(`file://${path.join(HALL, 'hall-visual.js').replace(/\\/g, '/')}`)).default;
+  assert.equal(typeof vis.taskVisualFigureHtml, 'function', 'the real visual module loaded');
+  assert.equal(typeof kit.taskVisualFigureHtml, 'undefined', 'and the kit no longer carries a second copy');
   const els = new Map();
   const el = (id) => {
     if (!els.has(id)) els.set(id, { id, innerHTML: '', textContent: '', hidden: false, value: '' });
@@ -258,6 +265,7 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
       errMessage: (d) => (d && d.error && d.error.message) || '',
     },
     OTBKit: kit,
+    OTBVisual: vis,
     scrollTo: () => {},
   };
   const document = { addEventListener: (t, h) => handlers.push({ t, h }) };

package/tests/task_visuals.mjs

@@ -13,13 +13,16 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
 const require = createRequire(import.meta.url);
 
 // Point storage at a throwaway dir BEFORE requiring the module.
 const TMP = path.join(os.tmpdir(), `otb-taskvisual-${process.pid}`);
 process.env.TASK_VISUALS_DIR = TMP;
 const tv = require('../modules/lifecycle/task-visuals.js');
-const kit = require('../modules/hall-ui/public/hall-kit.js');
+// The renderers left hall-kit.js for hall-visual.js (task 1003835) — the task
+// record page draws a visual and needs nothing else the kit holds.
+const vis = require('../modules/hall-ui/public/hall-visual.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -140,7 +143,7 @@ await t('persistImageBuffer: writes a name the serve route accepts, under the ri
   assert.equal(tv.taskIdFromName(r.file), 1003109);
   assert.equal(r.url, `/api/bongos/task-visuals/${r.file}`);
   // Both prefixes are permanent aliases, so a URL minted under either resolves.
-  assert.equal(kit.isTaskVisualUrl(r.url), true);
+  assert.equal(vis.isTaskVisualUrl(r.url), true);
   assert.equal(r.bytes, PNG.length);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.deepEqual(onDisk, PNG);
@@ -170,23 +173,23 @@ await t('deleteStored: removes by name or URL, is idempotent, refuses a traversa
 });
 
 // ---- the client-side URL guard --------------------------------------------
-await t('hall-kit: only a server-minted visual URL is ever rendered', () => {
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
-  assert.equal(kit.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
+await t('hall-visual: only a server-minted visual URL is ever rendered', () => {
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
+  assert.equal(vis.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
   // Anything that is not that exact shape renders nothing — including an
   // absolute URL to another origin, and a javascript: payload.
-  assert.equal(kit.isTaskVisualUrl('https://evil.example/x.png'), false);
-  assert.equal(kit.isTaskVisualUrl('javascript:alert(1)'), false);
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
-  assert.equal(kit.isTaskVisualUrl(''), false);
-  assert.equal(kit.isTaskVisualUrl(null), false);
-});
-
-await t('hall-kit: no visual renders nothing at all — never a placeholder', () => {
-  assert.equal(kit.shipVisualThumbHtml({ id: 1 }), '');
-  assert.equal(kit.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.shipVisualThumbHtml(null), '');
-  const html = kit.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
+  assert.equal(vis.isTaskVisualUrl('https://evil.example/x.png'), false);
+  assert.equal(vis.isTaskVisualUrl('javascript:alert(1)'), false);
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
+  assert.equal(vis.isTaskVisualUrl(''), false);
+  assert.equal(vis.isTaskVisualUrl(null), false);
+});
+
+await t('hall-visual: no visual renders nothing at all — never a placeholder', () => {
+  assert.equal(vis.shipVisualThumbHtml({ id: 1 }), '');
+  assert.equal(vis.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.shipVisualThumbHtml(null), '');
+  const html = vis.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
   assert.ok(html.includes('ship-visual-thumb'));
   // The caption is attacker-adjacent text (a builder wrote it) — it must be escaped.
   assert.ok(html.includes('"before"'));
@@ -194,18 +197,18 @@ await t('hall-kit: no visual renders nothing at all — never a placeholder', ()
 });
 
 // ---- the full-size figure (task 1003829) -----------------------------------
-await t('hall-kit: the full-size figure is the same guard, at reading size', () => {
+await t('hall-visual: the full-size figure is the same guard, at reading size', () => {
   // Same no-placeholder rule as the thumbnail: nothing at all without a visual.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1 }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.taskVisualFigureHtml(null), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1 }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.taskVisualFigureHtml(null), '');
   // And the same URL wall — an off-origin src or a javascript: payload is not
   // "rendered without a caption", it is not rendered.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
 
   const url = '/api/gds/task-visuals/task-1-0011223344556677.png';
-  const html = kit.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
+  const html = vis.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
   assert.ok(html.includes('<figure class="task-visual">'));
   assert.ok(html.includes('class="task-visual__img"'));
   // The caption is the SHIPPER's text — attacker-adjacent, so escaped in both
@@ -215,19 +218,80 @@ await t('hall-kit: the full-size figure is the same guard, at reading size', ()
 
   // The caller owns the size, so it owns the class base; anything but
   // [A-Za-z0-9_-] is stripped rather than interpolated into the attribute.
-  const studio = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
+  const studio = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
   assert.ok(studio.includes('<figure class="studio-plate">'));
   assert.ok(studio.includes('class="studio-plate__img"'));
-  const hostile = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
+  const hostile = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
   assert.ok(hostile.includes('<figure class="xonloada">'), hostile);
 
   // No written alt → no caption at all. The fallback alt is a machine sentence
   // for a screen reader, never a caption shown to a reader.
-  const bare = kit.taskVisualFigureHtml({ id: 7, visual_url: url });
+  const bare = vis.taskVisualFigureHtml({ id: 7, visual_url: url });
   assert.ok(!bare.includes('figcaption'));
   assert.ok(bare.includes('alt="Visual for task 7"'));
 });
 
+// ---- the convergence is the deliverable (task 1003835) ---------------------
+//
+// Reading the source is the right altitude here: the defect this task closes is
+// a SECOND definition existing, which no behavioural assertion against one of
+// them can see. A duplicate renderer passes every test above.
+
+const HALL = (f) => fsSync.readFileSync(new URL(`../modules/hall-ui/public/${f}`, import.meta.url), 'utf8');
+
+await t('hall-kit no longer defines a visual renderer', () => {
+  const kitSrc = HALL('hall-kit.js');
+  // The function DEFINITIONS are what must be gone — the pointer comment naming
+  // them is the thing that tells the next reader where they went, so match on
+  // the definition syntax rather than on the bare name.
+  assert.ok(!/function\s+taskVisualFigureHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines taskVisualFigureHtml');
+  assert.ok(!/function\s+shipVisualThumbHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines shipVisualThumbHtml');
+  assert.ok(!/function\s+isTaskVisualUrl\s*\(/.test(kitSrc), 'hall-kit.js still defines isTaskVisualUrl');
+  // …and it must not re-export them either, or callers keep two ways in.
+  const kitApi = require('../modules/hall-ui/public/hall-kit.js');
+  assert.equal(kitApi.taskVisualFigureHtml, undefined);
+  assert.equal(kitApi.shipVisualThumbHtml, undefined);
+  assert.equal(kitApi.isTaskVisualUrl, undefined);
+});
+
+await t('task.js renders through the shared module, not its own <figure>', () => {
+  const src = HALL('task.js');
+  assert.ok(src.includes('vis.taskVisualFigureHtml(t, { className: \'tk-visual\' })'),
+    'task.js should delegate to OTBVisual with its own class base');
+  // The hand-rolled markup is the thing that came back three times. If any of it
+  // reappears in this file, the convergence has been undone.
+  assert.ok(!src.includes('<figure class="tk-visual">'), 'task.js hand-rolls the figure again');
+  assert.ok(!src.includes('tk-visual__img'), 'task.js hand-rolls the img class again');
+  assert.ok(!src.includes('task-visuals/task-'), 'task.js carries its own copy of the URL guard again');
+});
+
+await t('every page whose script draws a visual actually loads hall-visual.js', () => {
+  // A missing <script> is the one failure this split introduces, and it is
+  // silent: the guard in each caller degrades to rendering nothing, so a visual
+  // would simply stop appearing with no error anywhere.
+  for (const page of ['index.html', 'profile.html', 'studio.html', 'task.html']) {
+    assert.ok(HALL(page).includes('/builders/hall-visual.js'), `${page} does not load hall-visual.js`);
+  }
+});
+
+await t('the callers reach for OTBVisual, and no longer for the kit', () => {
+  for (const f of ['hall-render.js', 'profile.js', 'studio.js', 'task.js']) {
+    const src = HALL(f);
+    assert.ok(!/OTBKit(\.|\[')?\s*(shipVisualThumbHtml|taskVisualFigureHtml|isTaskVisualUrl)/.test(src),
+      `${f} still reads a visual renderer off OTBKit`);
+  }
+  assert.ok(HALL('hall-render.js').includes('window.OTBVisual.shipVisualThumbHtml'));
+  assert.ok(HALL('studio.js').includes('vis.taskVisualFigureHtml('));
+});
+
+await t('the dead .td-visual rules are gone, and nothing emits the class', () => {
+  // task 1003829's comment and this task's own brief both asserted a second
+  // renderer in task-detail.js. `git log -S` shows that file never carried one:
+  // the CSS was the fossil of a renderer that was planned and not built.
+  assert.ok(!HALL('style.css').includes('.td-visual'), 'style.css still carries the dead rules');
+  assert.ok(!HALL('task-detail.js').includes('td-visual'));
+});
+
 // ---- cleanup ---------------------------------------------------------------
 await fs.rm(TMP, { recursive: true, force: true });