@bongos/core 1.19.870 → 1.19.872

package/tests/core_update_banner.mjs

@@ -0,0 +1,308 @@
+// tests/core_update_banner.mjs — the core-update banner, both halves (task 1004045).
+//
+// The 1003159 grade's lesson is the design constraint here: that task shipped two
+// guards that could never refuse, past a green suite, because every assertion read
+// SOURCE TEXT. So these EXECUTE — the verdict function against real inputs, the
+// registry read against a fake transport, and the banner against the real shell.js
+// in a DOM stub — and the one unavoidable source assertion is labelled as such.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const CU = require_(path.join(ROOT, 'src/bongos/core-update.js'));
+
+// The module exports exactly one function, so these helpers drive the real thing
+// through it rather than reaching past it into internals that no route uses.
+// `store` is per-call so the unit assertions never share the module's own cache.
+const freshStore = () => ({ at: 0, versions: [], ok: false, inflight: null });
+const verdictFor = (running, available, channel) =>
+  CU.readCoreUpdate({ running, channel, store: freshStore(), fetch: async () => ({ ok: true, versions: available }) });
+const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
+
+// ── the verdict ────────────────────────────────────────────────────────────────
+
+test('behind: names the newest version the channel permits', async () => {
+  const v = await verdictFor('1.19.861', ['1.19.860', '1.19.861', '1.19.871']);
+  assert.equal(v.behind, true);
+  assert.equal(v.latest, '1.19.871');
+  assert.equal(v.reading, 'ok');
+});
+
+test('current: not behind, and no version offered', async () => {
+  const v = await verdictFor('1.19.871', ['1.19.861', '1.19.871']);
+  assert.equal(v.behind, false);
+  assert.equal(v.latest, null);
+  assert.equal(v.reading, 'ok');
+});
+
+test('a MAJOR ahead is not an upgrade this banner offers', async () => {
+  // The runner refuses a major unattended, so offering one would be a button
+  // whose press is then refused — previewFromSnapshot avoids the same trap.
+  const v = await verdictFor('1.19.861', ['2.0.0']);
+  assert.equal(v.behind, false);
+});
+
+test('a prerelease ahead is not offered', async () => {
+  const v = await verdictFor('1.19.861', ['1.19.872-rc.1']);
+  assert.equal(v.behind, false);
+});
+
+test('NO ANSWER is not "up to date" — the distinction the banner turns on', async () => {
+  // A registry that cannot be reached, and a box that cannot name its own core:
+  // two different roads to the same must-say-nothing state.
+  const unreachable = await CU.readCoreUpdate({ running: '1.19.861', store: freshStore(), fetch: async () => ({ ok: false, versions: [] }) });
+  assert.equal(unreachable.reading, 'no_answer');
+  assert.equal(unreachable.behind, false);
+  const noVersion = await verdictFor(null, ['1.19.871']);
+  assert.equal(noVersion.reading, 'no_answer');
+});
+
+// ── the registry read: fail-soft, never a throw ───────────────────────────────
+
+function fakeGet(handler) {
+  return (_url, _opts, cb) => {
+    const listeners = {};
+    const res = {
+      statusCode: 200, resume() {}, setEncoding() {},
+      on(ev, fn) { (listeners[ev] ||= []).push(fn); return res; },
+    };
+    handler(res);
+    queueMicrotask(() => {
+      cb(res);
+      for (const fn of listeners.data || []) fn(res._body || '');
+      for (const fn of listeners.end || []) fn();
+    });
+    return { on() {}, destroy() {} };
+  };
+}
+
+test('a non-200 from the registry yields no answer and does not throw', async () => {
+  const v = await CU.readCoreUpdate({ running: '1.19.861', store: freshStore(), get: fakeGet((res) => { res.statusCode = 503; }) });
+  assert.equal(v.reading, 'no_answer');
+});
+
+test('an unparseable packument yields no answer and does not throw', async () => {
+  const v = await CU.readCoreUpdate({ running: '1.19.861', store: freshStore(), get: fakeGet((res) => { res._body = 'not json'; }) });
+  assert.equal(v.reading, 'no_answer');
+});
+
+test('a real packument is parsed, and its newest version reaches the verdict', async () => {
+  // Drives the ACTUAL https parsing path, only the socket is fake.
+  const v = await CU.readCoreUpdate({
+    running: '1.19.861', store: freshStore(),
+    get: fakeGet((res) => { res._body = JSON.stringify({ versions: { '1.19.861': {}, '1.19.871': {} } }); }),
+  });
+  assert.equal(v.reading, 'ok');
+  assert.equal(v.latest, '1.19.871');
+});
+
+test('the cache spares the registry a second read inside the TTL', async () => {
+  const store = freshStore();
+  let calls = 0;
+  const fetch = async () => { calls++; return { ok: true, versions: ['1.19.871'] }; };
+  let t = 1_000_000;
+  const now = () => t;
+  const args = { running: '1.19.861', store, fetch, now, ttlMs: 1000 };
+  await CU.readCoreUpdate(args);
+  await CU.readCoreUpdate(args);
+  assert.equal(calls, 1, 'second call served from cache');
+  t += 2000;
+  await CU.readCoreUpdate(args);
+  assert.equal(calls, 2, 'a call past the TTL re-reads');
+});
+
+test('concurrent cold-cache reads make ONE outbound call, not one each', async () => {
+  const store = freshStore();
+  let calls = 0;
+  const fetch = () => { calls++; return new Promise((r) => setTimeout(() => r({ ok: true, versions: ['1.19.871'] }), 5)); };
+  const args = { running: '1.19.861', store, fetch, now: () => 1 };
+  const all = await Promise.all([CU.readCoreUpdate(args), CU.readCoreUpdate(args), CU.readCoreUpdate(args)]);
+  assert.equal(calls, 1, 'three simultaneous cold reads share one registry call');
+  for (const v of all) assert.equal(v.latest, '1.19.871');
+});
+
+test('a failed read is NOT cached as an answer', async () => {
+  const store = freshStore();
+  let calls = 0;
+  const fetch = async () => { calls++; return { ok: false, versions: [] }; };
+  await CU.readCoreUpdate({ running: '1.19.861', store, fetch, now: () => 5 });
+  await CU.readCoreUpdate({ running: '1.19.861', store, fetch, now: () => 6 });
+  assert.equal(calls, 2, 'a failure must be retried, not remembered');
+});
+
+// ── the route's gate ──────────────────────────────────────────────────────────
+
+test('the route is gated by TWO middlewares before its handler', () => {
+  const router = require_(path.join(ROOT, 'src/bongos/routes/core-update.js'))();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/core-update');
+  assert.ok(layer, 'GET /core-update is registered');
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+});
+
+test('[source] the gate names core.pin.move, the deploy door’s own atom', () => {
+  // The one source-text assertion, and labelled: the middleware above is an opaque
+  // closure, so the ATOM it was built with cannot be read back off the stack. It
+  // guards against the gate being silently widened, not against it being absent —
+  // the layer count above is what proves a gate is there at all.
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/core-update.js'), 'utf8');
+  assert.match(src, /requirePermission\('core\.pin\.move'\)/);
+});
+
+// ── the route, driven as a REAL request ───────────────────────────────────────
+//
+// The grader's finding on the first round of this task, and it was right: every
+// route assertion above inspects the stack or the source, and NEITHER can see a
+// mis-shaped `asyncHandler` call — which is precisely the bug that shipped
+// (handler passed where the tag goes, so every request 500s). This drives an
+// actual HTTP request through the actual assembled router, with only the two auth
+// gates replaced, so the handler wiring is exercised end to end.
+
+test('a real request through the assembled router returns the verdict, not a 500', async () => {
+  // The route captures `auth` at module load, so the stubs must be installed in
+  // the require cache BEFORE it is first required — hence the fresh child require
+  // and the explicit cache delete.
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const savedBuilder = realAuth.requireBuilder;
+  const savedPerm = realAuth.requirePermission;
+  realAuth.requireBuilder = (_req, _res, next) => next();
+  realAuth.requirePermission = () => (_req, _res, next) => next();
+  delete r2.cache[routePath];
+
+  // Warm the module's OWN cache through the public door, so the route's own
+  // dependency-free call is served from it and the test never touches the network.
+  await CU.readCoreUpdate({ running: '1.19.861', fetch: async () => ({ ok: true, versions: ['1.19.861', '1.19.871'] }) });
+  const express = r2('express');
+  const app = express();
+  app.use(r2(routePath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/core-update`);
+    assert.equal(res.status, 200, 'the handler runs — a 500 here is the asyncHandler arity bug');
+    const body = await res.json();
+    assert.equal(body.ok, true);
+    assert.equal(body.update.reading, 'ok');
+    assert.ok('behind' in body.update, 'the verdict shape reaches the client');
+  } finally {
+    server.close();
+    realAuth.requireBuilder = savedBuilder;
+    realAuth.requirePermission = savedPerm;
+    delete r2.cache[routePath];
+  }
+});
+
+// ── the banner ────────────────────────────────────────────────────────────────
+
+function boot({ permissions, update, status = 200, dismissed = null, provisioning = true } = {}) {
+  const els = new Map();
+  const inserted = [];
+  const stored = {};
+  const requested = [];
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '', _children: [],
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+    addEventListener(ev, fn) { (this._on ||= {})[ev] = fn; },
+    querySelector() { return { addEventListener: (e, f) => { this._close = f; } }; },
+    querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, scrollIntoView() {}, remove() { this._removed = true; },
+    insertAdjacentElement(_pos, el) { inserted.push(el); },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    body: { dataset: { page: 'settings' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {}, dispatchEvent() {},
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
+    BongosClient: {
+      createClient: () => ({
+        request: (method, p) => {
+          requested.push(method + ' ' + p);
+          if (p === '/api/bongos/core-update') return Promise.resolve({ status, data: update ? { ok: true, update } : null });
+          return new Promise(() => {});
+        },
+      }),
+    },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: {
+      getItem: (k) => (k === 'bongos.coreUpdate.dismissed' ? dismissed : null),
+      setItem: (k, v) => { stored[k] = v; },
+    },
+    requestAnimationFrame() {}, scrollTo() {}, location, addEventListener() {},
+  };
+  const sandbox = { window: windowObj, document: documentObj, location, console, setTimeout, clearTimeout, queueMicrotask,
+    CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions });
+  return { inserted, stored, requested, banner: () => inserted.find((e) => String(e._html).includes('is available')) };
+}
+
+const BEHIND = { running: '1.19.861', latest: '1.19.871', behind: true, reading: 'ok' };
+
+test('an owner who is behind sees the banner, naming both versions', async () => {
+  const b = boot({ permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  const el = b.banner();
+  assert.ok(el, 'banner rendered');
+  assert.match(el.innerHTML, /1\.19\.871/);
+  assert.match(el.innerHTML, /1\.19\.861/);
+});
+
+test('a builder without the atom is never even asked about it', async () => {
+  const b = boot({ permissions: { 'task.create': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.equal(b.banner(), undefined);
+  assert.ok(!b.requested.includes('GET /api/bongos/core-update'), 'no request is made');
+});
+
+test('no answer renders no banner — not a false "up to date"', async () => {
+  const b = boot({ permissions: { 'core.pin.move': true }, update: { running: '1.19.861', latest: null, behind: false, reading: 'no_answer' } });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.equal(b.banner(), undefined);
+});
+
+test('a dismissal silences THAT version only', async () => {
+  const same = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, dismissed: '1.19.871' });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.equal(same.banner(), undefined, 'the dismissed version stays dismissed');
+
+  const newer = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, dismissed: '1.19.800' });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.ok(newer.banner(), 'a newer release re-announces itself');
+});
+
+test('the Upgrade action appears only where the deploy door exists', async () => {
+  const on = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, provisioning: true });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.match(on.banner().innerHTML, /href="\/deploy"/);
+
+  const off = boot({ permissions: { 'core.pin.move': true }, update: BEHIND, provisioning: false });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.ok(off.banner(), 'a tenant still hears the news');
+  assert.doesNotMatch(off.banner().innerHTML, /href="\/deploy"/, 'but is not offered a 404');
+});
+
+test('the banner is asked for ONCE, not on every access settle', async () => {
+  const b = boot({ permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  const first = b.requested.filter((r) => r.endsWith('/core-update')).length;
+  assert.equal(first, 1);
+});

package/tests/eviction_policy.mjs

@@ -6,7 +6,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { requireHostModule } from './helpers.mjs';
 const require = createRequire(import.meta.url);
-const { classifyEviction, estTokens, blockText, stubFor, normalize, readRange, isVolatileBash, salientTokens } = requireHostModule(require, '../.claude/hooks/eviction-policy.js');
+const { classifyEviction, estTokens, blockText, stubFor, normalize, readRange, isVolatileBash, salientTokens, DEFAULTS } = requireHostModule(require, '../.claude/hooks/eviction-policy.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -276,5 +276,26 @@ test('1364 unit: readRange + salientTokens edges', () => {
   assert.ok(!toks.has('plain'), 'a common short word is not distinctive');
 });
 
+// The claim lifecycle card is a neverEvictPattern, and its header is built from
+// branding (modules/lifecycle/ship-card.js renders productName + " · task #" + id).
+// The guard used to hardcode one instance name, so it silently stopped protecting
+// the card the moment the brand changed (task 1001784). Pin the BRAND-AGNOSTIC
+// shape instead: any product name, and a DIGIT after the hash -- a pattern that
+// loses the \d escape matches the literal letter d and so matches nothing real.
+// The three positive cases are documentary: the guard reads only the " · task #<digit>"
+// suffix, never the name, so they differ in SHAPE (one word, two words, a lowercase
+// interior word) to show a reader that the name is not part of the match.
+test('1001784: the lifecycle-card guard matches any brand, not one hardcoded name', () => {
+  const guarded = (text) => DEFAULTS.neverEvictPatterns.some((re) => re.test(text));
+  assert.ok(guarded('  Cloud Bongos · task #1001784        Claimed'), 'this instance');
+  assert.ok(guarded('  Acme Corp · task #42               Shipped'), 'any other brand');
+  assert.ok(guarded('  Port of Call · task #7              Claimed'), 'a multi-word brand with a lowercase interior word');
+  // The negative case must carry the same " · task #" prefix as a real card,
+  // or it fails for the wrong reason and passes under BOTH the buggy and the fixed
+  // regex. This string matches / · task #d/ and must NOT match / · task #\d/,
+  // which is exactly the escape this test exists to pin.
+  assert.ok(!guarded('  Cloud Bongos · task #d   Claimed'), 'a literal d is not a task number');
+});
+
 console.log(`\neviction_policy: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/git_guard.mjs

@@ -118,6 +118,74 @@ test('the PowerShell tool keeps the same false-positive floor as Bash', () => {
   }
 });
 
+// The four spellings PowerShell resolves to the same executable as a plain `git`
+// (task 1004028). It looks a command up case-insensitively, appends the extensions
+// in $env:PATHEXT, and eats a backtick as its escape character — so each of these
+// RUNS on a Windows laptop, and each one used to return block:false because the
+// guard matched a literal lower-case `git`.
+test('PowerShell spellings of the executable are blocked, not just the lower-case one', () => {
+  for (const cmd of [
+    'Git stash',
+    'GIT branch -D task-1',
+    'git.exe worktree remove ../wt',
+    'GIT.EXE push origin main',
+    'g`it push origin main',
+    'Git.exe -C ../wt stash',
+  ]) {
+    const r = pwsh(cmd);
+    assert.equal(r.status, 2, `PowerShell spelling went unguarded: ${cmd}`);
+    assert.match(r.stderr, /git-guard: blocked/);
+  }
+});
+
+// Git Bash is the `Bash` tool name on a case-insensitive Windows filesystem, where
+// `Git stash` and `git.exe stash` both resolve and run. The executable widening is
+// therefore not PowerShell-only. The backtick is: it is PowerShell's escape
+// character, and in Bash it opens a command substitution instead, so stripping it
+// there would invent a git invocation the shell never runs.
+test('the executable widening covers Bash too, but the backtick rule does not', () => {
+  for (const cmd of ['Git stash', 'git.exe push origin main', 'GIT worktree remove ../wt']) {
+    assert.equal(bash(cmd).status, 2, `Git-Bash spelling went unguarded: ${cmd}`);
+  }
+  assert.equal(bash('g`it push origin main').status, 0, 'a backtick is not an escape in Bash');
+});
+
+// Only the executable token folds. `git Stash` is an error git itself refuses, and
+// `-d` vs `-D` is the entire point of the fourth rule — folding the flags would
+// block the safe delete and make the guard useless.
+test('subcommands and flags stay case-sensitive', () => {
+  for (const cmd of [
+    'Git Stash',
+    'GIT STASH',
+    'Git branch -d merged-branch',
+    'git.exe PUSH origin main',
+    'Git WORKTREE remove ../wt',
+  ]) {
+    for (const run of [bash, pwsh]) {
+      assert.equal(run(cmd).status, 0, `folded a subcommand or flag it must not fold: ${cmd}`);
+    }
+  }
+});
+
+// The read-only and ordinary shapes keep passing in every spelling: widening the
+// executable must not cost the guard its false-positive floor.
+test('the widened executable keeps the false-positive floor in every spelling', () => {
+  for (const cmd of [
+    'Git stash list',
+    'git.exe status',
+    'GIT push origin task-1004028',
+    'Git branch -d merged',
+    'git.exe worktree list --porcelain',
+    'Github Actions rerun',
+    'gitk --all',
+    'node scripts/gds/worktree.js remove wt-1',
+  ]) {
+    for (const run of [bash, pwsh]) {
+      assert.equal(run(cmd).status, 0, `false positive on: ${cmd}`);
+    }
+  }
+});
+
 test('a non-shell tool and unknown payload shapes still fail open', () => {
   assert.equal(
     runHook(JSON.stringify({ tool_name: 'Write', tool_input: { file_path: 'x.js', content: 'git stash' } })).status,

package/tests/goal_criterion_confirm_ui.mjs

@@ -105,6 +105,13 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const pager = (prefix) => ({ prefix, page: 1, perPage: 25 });
   const windowObj = {
     OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
       escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch])),
       $, fmtNum: (n) => String(n), fmtDate: () => '', rankLabel: (r) => r,
       toast: (m) => calls.toasts.push(m),

package/tests/goal_invite_consent.mjs

@@ -142,6 +142,13 @@ function harness({ pendingRequests = [] } = {}) {
     scrollTo() {}, addEventListener() {},
     matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
     OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
       escapeHtml: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
       $: (sel) => documentObj.querySelector(sel),
       fmtNum: (n) => String(n ?? ''),

package/tests/goal_sort_staleness.mjs

@@ -115,8 +115,12 @@ await test('a filter control may mix string and {value,label} options — the ki
   const kit = read('modules/hall-ui/public/hall-kit.js');
   assert.match(kit, /function optVal\(o\) \{ return typeof o === 'string' \? o : o\.value; \}/);
   assert.match(kit, /function optLabel\(o\) \{ return typeof o === 'string' \? o : o\.label; \}/);
-  assert.match(WORK_SRC, /id: 'f-discipline',[\s\S]{0,200}'engineer', 'artist', 'ideator', 'ui', 'unclassified'/,
-    'the mixed form predates this task on the very same board');
+  // task 1003936 moved f-discipline off the literal list and onto OTB.roleOptions(),
+  // so the live example of the MIXED form is now f-goal-status. The invariant under
+  // test is the kit's normalisation, not which control happens to exercise it.
+  const GOALS_SRC = read('modules/hall-ui/public/goals-page.js');
+  assert.match(GOALS_SRC, /id: 'f-goal-status',[\s\S]{0,120}'open', 'achieved', 'archived'/,
+    'the mixed form is still live on a real control');
 });
 
 // ---- the payload, which is where the scale actually bit ---------------------

package/tests/goal_subtitle.mjs

@@ -184,6 +184,27 @@ test('an unset subtitle is hidden; a set one is shown trimmed', () => {
   assert.equal(els.sub.textContent, 'the grep path');
 });
 
+// goalTitleRegions — where the row's title ends and the card's begins, as an
+// ANCHOR rather than a byte count (task 1004036).
+//
+// The assertion below and the vacuity guard further down BOTH derive the row's
+// region from here, deliberately. The previous shape asserted subtitleAttr(g)
+// absent from a 160-char window while the row's real region measured 766 — 21%
+// of the span it claimed to check — and a negative assertion passes when it
+// finds nothing, which is also what it does when it is looking in the wrong
+// place. Injecting the tooltip into the row left it passing.
+//
+// One derivation, not two: a guard that recomputed the region itself would stay
+// green while the assertion it claims to protect was narrowed back. Narrow this
+// function and the guard fails, which is the only arrangement that makes the
+// guard worth having.
+function goalTitleRegions(js) {
+  const row = js.indexOf('class="gr-title"');
+  const card = js.indexOf('class="goal-card__title gr-title"');
+  assert.ok(card > row, 'card title boundary not found — re-anchor this slice to whatever now follows the row title');
+  return { row, card, rowRegion: js.slice(row, card) };
+}
+
 test('on a LIST the subtitle is a visible line; on the CARD it stays a tooltip', () => {
   // task 1003206: the row/card painters moved to goals-render.js — the second half
   // of the carve goals-lib.js began — so read the family, not one filename.
@@ -197,15 +218,38 @@ test('on a LIST the subtitle is a visible line; on the CARD it stays a tooltip',
   // task 1003307 gave the ROW its line back on the owner's call: 35 of 72 goals
   // carry a subtitle, and a tooltip does not exist on a touch screen. The CARD
   // has no room for a line, so it keeps the tooltip (task 1003224's shape).
-  const row = js.indexOf('class="gr-title"');
+  const { row, card, rowRegion } = goalTitleRegions(js);
   assert.ok(row > 0, 'the row title is still rendered');
-  assert.match(js.slice(row, row + 200), /subtitleLine\(g\)/, 'the row renders the visible line');
-  assert.doesNotMatch(js.slice(row, row + 160), /subtitleAttr\(g\)/, 'the row does not also carry the tooltip');
-  const card = js.indexOf('class="goal-card__title gr-title"');
   assert.ok(card > 0, 'the card title is still rendered');
+  assert.match(rowRegion, /subtitleLine\(g\)/, 'the row renders the visible line');
+  assert.doesNotMatch(rowRegion, /subtitleAttr\(g\)/, 'the row does not also carry the tooltip');
   assert.match(js.slice(card, card + 160), /subtitleAttr\(g\)/, 'the card carries the tooltip');
 });
 
+// ---- the negative assertion above is not vacuous (task 1004036) -------------
+// A negative assertion passes when it finds nothing, which is also what it does
+// when it is looking in the wrong place — so one that has never been watched
+// FAIL is not evidence of anything. The previous shape checked subtitleAttr(g)
+// was absent from a 160-char window while the row's real region measured 766,
+// so it verified 21% of the span it claimed to; injecting the tooltip into the
+// row left it passing. This case does that injection and requires the anchored
+// region to catch it. It guards the ASSERTION, not the page.
+test('the row/tooltip check CATCHES a row that carries the tooltip', () => {
+  const js = goalsPageSource();
+  const { row, card } = goalTitleRegions(js);
+
+  // Inject the forbidden attribute INSIDE the row's region but past the old
+  // 160-char window — the exact regression the assertion exists to catch.
+  const at = row + Math.floor((card - row) / 2);
+  const broken = js.slice(0, at) + ' title="${subtitleAttr(g)}" ' + js.slice(at);
+
+  // Through the SAME derivation the assertion uses, so narrowing it reds here.
+  assert.throws(
+    () => assert.doesNotMatch(goalTitleRegions(broken).rowRegion, /subtitleAttr\(g\)/),
+    'the row region does not notice a tooltip added to the row — the check is vacuous again',
+  );
+});
+
 test('every CSS token the new styles use actually exists', () => {
   // copy-desk.css shipped with --line and --panel, which style.css never
   // defines, so its fallbacks rendered as nothing (idea 1000821).

package/tests/hall_board_world.mjs

@@ -534,7 +534,10 @@ test('a backlog row names its craft and its goal', () => {
   const backlog = workJs.slice(workJs.indexOf('function renderBacklog'));
   // The same vocabulary the Ready card has carried since 1755 — a second spelling
   // would let the two tabs describe one task differently.
-  assert.match(backlog, /const discipline = t\.discipline \|\| 'unclassified'/);
+  // task 1003936: the backlog row reads the ONE role vocabulary instead of the
+  // stored default. Same invariant (the row carries a role tag), new spelling.
+  assert.match(backlog, /window\.OTB\.roleIsUnset\(t\.discipline\)/);
+  assert.match(backlog, /window\.OTB\.roleLabel\(t\.discipline\)/);
   assert.match(backlog, /disciplineTag/, 'the row renders the discipline tag');
   assert.match(backlog, /taskState\.goalTitles \|\| \{\}/, 'the goal is named by TITLE, not by bare id');
   assert.match(backlog, /'No goal'/, 'and a goal-less row says so rather than rendering a gap');

package/tests/hall_builders_page_pass.mjs

@@ -65,6 +65,13 @@ function hallRender(joinability) {
   const sandbox = {
     window: {
       OTB: {
+        // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+        // the same reason categoryChip is: an undefined helper throws mid-render.
+        roleAxisLabel: () => 'Role',
+        roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+        roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+        roleIsUnset: (d) => !d || d === 'unclassified',
+        ROLE_UNSET: 'unclassified',
         escapeHtml,
         $: (sel) => nodes[sel] || null,
         fmtNum: (n) => String(n),

package/tests/hall_landing_boot.mjs

@@ -68,6 +68,13 @@ async function boot({ meStatus }) {
     __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => api },
     OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
       moduleOn: () => true,
       escapeHtml: (s) => String(s == null ? '' : s),
       $: () => makeEl(),

package/tests/hall_profile_world.mjs

@@ -154,6 +154,13 @@ function bootCharts() {
     window: {
       __BRANDING__: { currency: { label: 'drachmae' } },
       OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
         escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
         $: () => null,
         fmtNum: (n) => String(n ?? 0),
@@ -220,10 +227,14 @@ test('craftMix sorts by count and folds the tail past seven into "other" — nev
   const rows = ['a', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', null].map((d) => ({ discipline: d }));
   const mix = plain(C.craftMix(rows));
   assert.equal(mix.length, 7);
-  assert.deepEqual(mix[0], { label: 'a', n: 2 });
+  // task 1003936: the bucket label is now the DISPLAY name (OTB.roleLabel), so a
+  // synthetic 'a' reads 'A'. The invariant under test is the sort and the fold.
+  assert.deepEqual(mix[0], { label: 'A', n: 2 });
   assert.equal(mix[6].label, 'other');
   assert.equal(mix.reduce((s, k) => s + k.n, 0), rows.length, 'nothing is lost in the fold');
-  assert.ok(C.craftMix([{ discipline: null }]).some((k) => k.label === 'unclassified'), 'a missing craft reads as unclassified');
+  // task 1003936: a missing role is still its own bucket, but the LABEL is a
+  // phrase a person would say, not the column default (docs/voice.md V2).
+  assert.ok(C.craftMix([{ discipline: null }]).some((k) => k.label === 'No role yet'), 'a missing role reads as "No role yet"');
   assert.equal(C.craftMix(rows.slice(0, 3)).length, 2, 'under the cap there is no fold');
 });
 
@@ -288,6 +299,13 @@ function bootRender({ rows, status = 200, analytics = null, ledger = [] }) {
       __BRANDING__: { currency: { label: 'drachmae' } },
       localStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)) },
       OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
         escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
         $: (sel) => (sel === '#charts-grid' ? mount : sel === '#charts-controls' ? controls : null),
         fmtNum: (n) => String(n ?? 0),

package/tests/hall_record_world.mjs

@@ -347,6 +347,13 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     __BRANDING__: { currency: { label: 'credits' } }, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
     OTB: {
+      // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
+      // the same reason categoryChip is: an undefined helper throws mid-render.
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleIsUnset: (d) => !d || d === 'unclassified',
+      ROLE_UNSET: 'unclassified',
       escapeHtml,
       $: (sel) => documentObj.querySelector(sel),
       fmtDate: (iso) => String(iso).slice(0, 10),