@bongos/core 1.19.902 → 1.19.904

package/tests/cli_surface.mjs

@@ -205,7 +205,7 @@ function guidanceOutput(fn, env) {
   return out;
 }
 
-const GUIDANCE = ['printUnauthGuidanceAndExit', 'printBoxScopeGuidanceAndExit', 'requireSession'];
+const GUIDANCE = ['printUnauthGuidanceAndExit', 'requireSession'];
 
 test('no guidance path speaks slash commands to a terminal reader', () => {
   for (const fn of GUIDANCE) {
@@ -220,7 +220,6 @@ test('the agent still gets its slash commands from those same paths', () => {
   // The inverse guard: a blanket rewrite that "fixed" the leak by deleting the slash commands
   // would break the reader they were written for, and nothing else here would notice.
   assert.match(runGuidance('printUnauthGuidanceAndExit', {}), /\/builder-reauth/);
-  assert.match(runGuidance('printBoxScopeGuidanceAndExit', {}), /\/builder-reauth/);
   assert.match(runGuidance('requireSession', {}), /\/builder-setup/);
 });
 
@@ -231,7 +230,6 @@ test('every shipped script that names a slash command routes it through the surf
   const ALLOWED = new Set([
     'scripts/gds/cli-lib.js',        // agent side of the three branches, proven above
     'scripts/gds/setup.js',          // re-run + newcomer-path lines, asserted below
-    'scripts/gds/box-connect-lib.js',// key-registration hint, asserted below
     'scripts/gds/surface.js',        // the switch itself
     'scripts/gds/start.js',          // section 3's documented agent-only exemptions
   ]);
@@ -257,88 +255,3 @@ test('setup.js routes its newcomer path and re-run lines through the surface', (
   assert.ok(!/console\.log\('  2\. Survey work:       \/builder-start'\)/.test(src), 'hard-coded /builder-start left in setup.js');
   assert.match(src, /re-run \$\{surfaceAction\('setup'\)\}/, 'the re-run lines must use surfaceAction');
 });
-
-test('box-connect-lib names the box command for the reader it has', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'box-connect-lib.js'), 'utf8');
-  assert.ok(!/add it via \/builder-box/.test(src), 'hard-coded /builder-box left in box-connect-lib.js');
-  assert.match(src, /add it via \$\{surfaceAction\('box'\)\}/);
-});
-
-// ── 5. The dead end: an instance with no dev box (task 1003730) ─────────────────────────────
-//
-// `bongos claim N` refuses and points at `bongos shell`. On an instance whose manifest carries
-// no dev-box module that call 404s, so the public CLI's only offered route to a checkout was a
-// hard error — a newcomer could see the work and not start it. The manifest always said so;
-// nothing read it.
-
-const cliLib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
-
-test('the manifest decides, and only an explicit roster can prove absence', () => {
-  assert.equal(cliLib.devBoxEnabledInManifest({ modules: { enabled: { 'dev-box': true } } }), true);
-  assert.equal(cliLib.devBoxEnabledInManifest({ modules: { enabled: { economy: true } } }), false);
-});
-
-test('the check fails OPEN — a hiccup must never block a working box', () => {
-  // Every one of these is "I could not tell", and the safe answer to that is to proceed and let
-  // the real API call speak. Failing closed here would break `bongos shell` on every instance
-  // running a core too old to publish a module roster.
-  for (const manifest of [null, undefined, {}, { modules: {} }, { modules: { enabled: null } }, 'nonsense']) {
-    assert.equal(cliLib.devBoxEnabledInManifest(manifest), true, `should fail open for ${JSON.stringify(manifest)}`);
-  }
-});
-
-test('the explanation names a command the reader can actually run', () => {
-  // It routes through the same switch as everything else: a terminal reader must not be handed
-  // `/builder-claim`, and an agent in a checkout must still get it.
-  const prev = process.env.BONGOS_SURFACE;
-  try {
-    process.env.BONGOS_SURFACE = 'terminal';
-    const term = cliLib.devBoxUnavailableMessage();
-    assert.ok(!/\/builder-/.test(term), `slash command in the terminal dev-box message: ${term}`);
-    assert.match(term, /bongos claim N/);
-    assert.match(term, /doesn't offer cloud dev boxes/);
-    assert.match(term, /checkout/, 'must name the actual alternative, not just refuse');
-
-    delete process.env.BONGOS_SURFACE;
-    assert.match(cliLib.devBoxUnavailableMessage(), /\/builder-claim N/, 'agents keep the slash command');
-  } finally {
-    if (prev === undefined) delete process.env.BONGOS_SURFACE;
-    else process.env.BONGOS_SURFACE = prev;
-  }
-});
-
-test('both box entry points check BEFORE they touch the box API', () => {
-  // Ordering is the whole point: key registration hits the box API too, so gating only the
-  // ensure call still printed "Could not register your key (not_found)" first.
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'box-connect-lib.js'), 'utf8');
-  assert.match(
-    src,
-    /async function prepareConnection\([^)]*\) \{[\s\S]{0,400}?await assertDevBoxAvailable\(\);[\s\S]{0,200}?ensureSshKey/,
-    'prepareConnection must assert before ensureSshKey/key registration',
-  );
-  assert.match(
-    src,
-    /async function ensureBoxActive\([^)]*\) \{\s*await assertDevBoxAvailable\(\);/,
-    'ensureBoxActive must assert before postBoxEnsure',
-  );
-});
-
-test('the raw box passthrough explains a 404 too', () => {
-  // `bongos box` is api.js aimed at POST /box/ensure, so without this it dumped a bare 404 body.
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'api.js'), 'utf8');
-  assert.match(src, /instanceDevBoxSupport/, 'api.js must consult the dev-box check');
-  assert.match(src, /res\.status === 404/, 'only on a 404');
-  assert.match(src, /\\\/box\\b/, 'and only for a box path — api.js stays generic');
-});
-
-test('the generated dispatcher does not promise a dev box it cannot verify', () => {
-  // The dispatcher has no session or manifest yet, so it must present `bongos shell` as
-  // conditional. Stating it flatly is what sent newcomers into the 404.
-  const gen = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js'), 'utf8');
-  assert.ok(
-    !/'To get a checkout without installing anything locally/.test(gen),
-    'the unconditional promise is back in the checkout-only refusal',
-  );
-  assert.match(gen, /If this instance offers cloud dev boxes/);
-  assert.match(gen, /Not every instance runs dev boxes/);
-});

package/tests/collab_page.mjs

@@ -421,6 +421,50 @@ test('the SIDEBAR badge: the Collab item declares the help_requests count', () =
   assert.match(fn, /href: '\/collab'/, 'pointing at the page, not the retired hash view');
 });
 
+// ---- THE MINGLE ROW SPEAKS THE ROLE ---------------------------------------
+// task 1003967 (artist review of 1003960). Run, not grepped: the first version of this
+// guard matched identifier names in the source, which would have agreed with a swapped
+// article just as happily as with a correct one. The sentence is pure, so execute it.
+
+test('the mingle sub-line reads as English for every pair, and never shows the column', () => {
+  const L = lib();
+  const OTB = domUtils();
+  const word = (d) => (OTB.roleIsUnset(d) ? '' : OTB.roleWord(d));
+  const line = (a, b) => L.pairSentence(word(a), word(b));
+
+  assert.equal(line('engineer', 'artist'), 'An engineer — you are an artist. Mingle pairs across roles.');
+  assert.equal(line('artist', 'ideator'), 'An artist — you are an ideator. Mingle pairs across roles.');
+
+  // 'ui' is the acronym exception roleWord() already makes, and it is why the article
+  // cannot be a plain vowel test — "an UI" is how that shortcut fails.
+  assert.equal(line('ui', 'engineer'), 'A UI — you are an engineer. Mingle pairs across roles.');
+  assert.equal(line('engineer', 'ui'), 'An engineer — you are a UI. Mingle pairs across roles.');
+});
+
+test('a pair with an unset role drops the comparison rather than naming the default', () => {
+  const L = lib();
+  const OTB = domUtils();
+  const word = (d) => (OTB.roleIsUnset(d) ? '' : OTB.roleWord(d));
+
+  // The defect this replaced rendered the database's own word — "A unclassified — you are
+  // a engineer" — which is the example V2 names. Nothing a person did not choose may reach
+  // the sentence, whichever side is missing.
+  for (const pair of [[OTB.ROLE_UNSET, 'engineer'], ['engineer', OTB.ROLE_UNSET], [null, 'artist'], ['', '']]) {
+    const out = L.pairSentence(word(pair[0]), word(pair[1]));
+    assert.equal(out, 'Mingle pairs across roles.', `pair ${JSON.stringify(pair)}`);
+    assert.doesNotMatch(out, /unclassified/);
+  }
+});
+
+test('aOrAn is the article rule, stated once', () => {
+  const L = lib();
+  assert.equal(L.aOrAn('engineer'), 'an');
+  assert.equal(L.aOrAn('artist'), 'an');
+  assert.equal(L.aOrAn('ideator'), 'an');
+  assert.equal(L.aOrAn('UI'), 'a', 'the acronym is spoken "you-eye", so it takes "a"');
+  assert.equal(L.aOrAn('ui'), 'a');
+});
+
 // ---- THE ANSWERABLE CLAUSE ------------------------------------------------
 test('the asker can settle in place, with both outcomes', () => {
   const js = read('modules', 'hall-ui', 'public', 'collab.js');

package/tests/hall_kit_charts.mjs

@@ -15,6 +15,7 @@
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
 import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
@@ -642,6 +643,43 @@ test('CAL: a one-week window says "week", and the full window still says "the la
   assert.match(full, /over the last year/, 'the 53-week window is a year and should read like one');
 });
 
+// --- task 1003621 (artist review of 1003583): ONE name for the drawn window ---------
+
+test('CAL: the window carries its own name, and the aria summary uses that name', () => {
+  // The half the arithmetic fix left behind. 1003583 made the summary and the caption
+  // COUNT the same window; they still DESCRIBED it differently — the aria summary said
+  // "the last year" (a rolling 53 weeks, which is what is drawn) while the caption under
+  // the same grid said "this year" (a calendar year, which is not). V3 asks the
+  // accessible line and the visible one to state the same fact, so the phrase now lives
+  // on the window itself and both read it.
+  for (const weeks of [1, 6, 53]) {
+    const win = kit.calendarWindow([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks });
+    assert.ok(win && typeof win.spanLabel === 'string' && win.spanLabel.length,
+      `calendarWindow must name its own window (weeks=${weeks})`);
+    const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks });
+    assert.ok(html.includes(`over ${win.spanLabel}:`),
+      `the aria summary must use the window's own name, not a second copy of the rule (weeks=${weeks})`);
+  }
+});
+
+test('CAL: the caption under the grid cannot drift back to "this year"', () => {
+  // The caption is rendered by profile-charts.js from win.spanLabel. What is pinned here
+  // is the phrase it must never go back to: a calendar year is not the window drawn, and
+  // a reader comparing the number to the picture is the person who pays for the gap.
+  const win = kit.calendarWindow([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 53 });
+  assert.equal(win.spanLabel, 'the last year');
+
+  // Asserted against the SOURCE because the caption is assembled in a browser global the
+  // unit lane does not render. The same idiom tests/modules_route_wiring.mjs uses.
+  const src = readFileSync(new URL('../modules/hall-ui/public/profile-charts.js', import.meta.url), 'utf8');
+  assert.match(src, /spanLabel/, 'the caption must take the window name from the window');
+  assert.doesNotMatch(
+    src, /shipped this year/,
+    'the caption said "this year" while the grid drew a rolling 53 weeks and the aria '
+    + 'summary said "the last year" — one window, two names, which is the V3 break',
+  );
+});
+
 test('CAL: the summary counts only the days the grid actually draws', () => {
   // 2026-09-03 is a Thursday, so a 2-week grid starts at Sunday 2026-08-23. A ship on
   // 2026-08-01 is real history the caller supplied, but it is off this picture, and it

package/tests/plain_cards.mjs

@@ -107,7 +107,7 @@ test('every card is complete, and short enough to be read', () => {
 
 test('the restrictions that must never be worked around are marked by_design', () => {
   for (const code of ['REBASE_REQUIRED', 'INSUFFICIENT_RANK', 'rank_too_low_for_task', 'session_already_has_active_claim',
-    'main_checkout_claim', 'ship:protected_branch', 'ship:auth', 'box_scope', 'no_push_credential', 'grade_refused_authorization']) {
+    'main_checkout_claim', 'ship:protected_branch', 'ship:auth', 'no_push_credential', 'grade_refused_authorization']) {
     assert.equal(cardFor(code)?.by_design, true, code);
   }
   assert.match(cardFor('no_push_credential').next, /never ask/i);
@@ -164,7 +164,7 @@ test('a person at a terminal gets no card — it is written in the agent\'s voic
 
 test('the sign-in printers, the release refusals and the claim guard each print their card', () => {
   const wired = {
-    'scripts/gds/cli-lib.js': ['session_invalid', 'box_scope', 'no_session'],
+    'scripts/gds/cli-lib.js': ['session_invalid', 'no_session'],
     'scripts/gds/release.js': ['no_active_claim', 'CLAIM_SESSION_MISMATCH'],
     'scripts/gds/claim.js': ['main_checkout_claim'],
     'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked'],

package/tests/rank_tier_single_source.mjs

@@ -12,7 +12,7 @@
 //      modules/discord/discord-channels.js): dependency-free substrate
 //      (permission-path-check runs in a bare git hook), source-parsed literals
 //      (src/bongos/db.js — gate-review.js + diagram-facts.js regex its text),
-//      standalone CLIs (sequence, box-connect-lib), the require-free dev-box
+//      standalone CLIs (sequence), the require-free dev-box
 //      module template (boxes.js), zero-dep catalog + its text-parsing auditor
 //      (route-rank-check), and the hall browser statics.
 //   3. NO NEW parallel map can land: a repo scan flags any rank→number map or
@@ -38,7 +38,6 @@ const lifecycleDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const sequence = require(path.join(ROOT, 'scripts', 'gds', 'sequence.js'));
-const boxConnect = require(path.join(ROOT, 'scripts', 'gds', 'box-connect-lib.js'));
 const boxes = require(path.join(ROOT, 'modules', 'dev-box', 'boxes.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
@@ -82,8 +81,8 @@ test('1-based local copies match: permission-path-check, sequence CLI', () => {
   assert.deepEqual(sequence.RANK_TIER, TIER, 'sequence.js CLI copy drifted');
 });
 
-test('0-based local copies match: box-connect-lib CLI, dev-box boxes.js', () => {
-  for (const [name, map] of [['box-connect-lib', boxConnect.RANK_ORDER], ['boxes', boxes.RANK_ORDER]]) {
+test('0-based local copies match: dev-box boxes.js', () => {
+  for (const [name, map] of [['boxes', boxes.RANK_ORDER]]) {
     assert.deepEqual(Object.keys(map).sort(), [...RANK_KEYS].sort(), `${name} keys drifted`);
     for (const r of RANK_KEYS) {
       assert.equal(map[r], TIER[r] - 1, `${name}.RANK_ORDER.${r} must be tier-1 (0-based)`);
@@ -193,7 +192,6 @@ const MAP_ALLOWLIST = new Set([
   'src/bongos/db.js',
   'src/bongos/permission-path-check.js',
   'scripts/gds/sequence.js',
-  'scripts/gds/box-connect-lib.js',
   'modules/dev-box/boxes.js',
   'modules/hall-ui/public/builders.js',
   // task 1003206 carved the hall page scripts up. builders.js KEPT its map (the