@bongos/core 1.19.972 → 1.19.974

package/tests/idea_spark_hall.mjs

@@ -65,6 +65,15 @@ function boot({
   // `{ outcome: null }`, which is the server saying "nothing to state yet"; the
   // line must go quiet for both, and there is a case below for each.
   landing = undefined,
+  // OUT-OF-ORDER READS (task 1004108). Names of fakes whose answers are PARKED
+  // instead of returned: the call is recorded and its response computed at once,
+  // but the caller's `await` does not resolve until the test releases it. That is
+  // the only way two reads of the same endpoint are ever in flight together here
+  // — every other fake is an `async` function that settles before the next call
+  // is made, so a monotonic-sequence guard sits on an unreachable branch and
+  // deleting it reds nothing. Pass e.g. `defer: ['preview']` and drive
+  // `r.deferred` in whatever order the race being pinned requires.
+  defer = [],
 } = {}) {
   const els = new Map();
   const makeEl = () => ({
@@ -88,6 +97,21 @@ function boot({
   };
 
   const calls = [];
+
+  // Parked calls, in REQUEST order. Each carries the name it was made under, the
+  // arguments it was made with, and `release()` — which hands the caller the
+  // answer the fake had already computed. Releasing out of order is the point.
+  const deferred = [];
+  const deferSet = new Set(defer);
+  const gate = (name, fn) => (...args) => {
+    const answer = fn(...args); // record the call and compute the reply NOW...
+    if (!deferSet.has(name)) return answer;
+    let release;
+    const held = new Promise((resolve) => { release = resolve; });
+    deferred.push({ name, args, release: () => release(answer) }); // ...hand it over LATER
+    return held;
+  };
+
   const client = {
     inbox: {
       getInboxTemplate: async () => ({ status: 200, ok: true, data: { template: TEMPLATE } }),
@@ -117,7 +141,7 @@ function boot({
       // real matrix for the fixtures this file already files with: a goal named
       // ⇒ it lands there, no goal ⇒ it floats. A test that cares about a
       // particular verdict passes `landing` and overrides the lot.
-      postInboxPreviewLanding: async (a) => {
+      postInboxPreviewLanding: gate('preview', async (a) => {
         calls.push(['preview', a]);
         if (landing === null) return { status: 500, ok: false, data: null };
         if (landing !== undefined) return { status: 200, ok: true, data: landing };
@@ -127,7 +151,7 @@ function boot({
           return { status: 200, ok: true, data: { outcome: 'routed', reason: 'bug_trusted_filer', status: 'ready', goal: { id: String(gid), title: g ? g.title : `goal ${gid}` }, version_id: 'BV1', refusal: null } };
         }
         return { status: 200, ok: true, data: { outcome: 'floats', reason: 'no_goal', status: null, goal: null, version_id: null, refusal: null } };
-      },
+      }),
     },
     // task 1003069 (R08) — the quick-filing goal picker's reads: the building
     // versions (to scope the suggester) and the open goal list (the picker's
@@ -137,7 +161,7 @@ function boot({
     },
     goals: {
       getGoals: async () => { calls.push(['goals', null]); return { status: 200, ok: true, data: { goals } }; },
-      getGoalsSuggestions: async (a) => { calls.push(['suggest', a]); return { status: 200, ok: true, data: { suggestions } }; },
+      getGoalsSuggestions: gate('suggest', async (a) => { calls.push(['suggest', a]); return { status: 200, ok: true, data: { suggestions } }; }),
     },
   };
 
@@ -173,7 +197,7 @@ function boot({
 
   const el = (id) => documentObj.getElementById(id);
   return {
-    calls, toasts, store, el,
+    calls, toasts, store, el, deferred,
     queueHtml: () => el('fi-queue').innerHTML,
     fill: () => { for (const f of TEMPLATE.fields) el(`fi-f-${f.key}`).value = `an answer for ${f.key} long enough to count`; },
     submit: () => el('fi-form')._handlers.submit({ preventDefault() {} }),
@@ -678,11 +702,67 @@ await test('filing clears the line — gravity describes a draft, and the draft
   assert.equal(r.el('fq-receipts').hidden, false, 'the RECEIPT is what survives instead (task 1004082)');
 });
 
+// --- out-of-order reads (task 1004108) -----------------------------------
+//
+// Everything above this line drives fakes that settle before the next call is
+// made, so `refreshGravity`'s monotonic `gravitySeq` guard sat on a branch no
+// case could reach: deleting it redded NOTHING, which the closing note below
+// used to record as an honest gap. `boot({ defer: [...] })` parks a named fake's
+// answer until the test hands it back, so two reads are genuinely in flight at
+// once and the slower one can land last.
+
+await test('two previews are genuinely in flight at once — the harness can interleave them', async () => {
+  // The non-vacuity guard for the case beneath it. If `defer` ever stopped
+  // parking, the race case below would still pass — it would just be testing two
+  // sequential reads again, which is the exact hole this pair exists to close.
+  const r = boot({ defer: ['preview'] });
+  await settle(); await settle();
+  r.el('fq-title').value = 'a loose thought';
+  r.el('fq-goal')._handlers.change();
+  await settle(); await settle();
+  assert.equal(r.deferred.length, 1, 'the first read is parked, not answered');
+  assert.equal(r.el('fq-gravity').textContent, '', 'and nothing is painted while it is in flight');
+  r.el('fq-goal').value = '77';
+  r.el('fq-goal')._handlers.change();
+  await settle(); await settle();
+  assert.equal(r.deferred.length, 2, 'the second read starts while the first is still unanswered');
+  assert.deepEqual(r.deferred.map((d) => d.name), ['preview', 'preview']);
+});
+
+await test('a slow preview answering after a faster one never repaints the stale verdict', async () => {
+  // The race a builder hits by picking a goal and then changing their mind
+  // faster than the server answers. The FIRST request (no goal ⇒ "floats") comes
+  // back LAST; the line must keep the SECOND request's verdict.
+  const r = boot({ defer: ['preview'] });
+  await settle(); await settle();
+  r.el('fq-title').value = 'the widget is broken';
+  r.el('fq-goal').value = '';
+  r.el('fq-goal')._handlers.change();
+  await settle();
+  r.el('fq-goal').value = '77';
+  r.el('fq-goal')._handlers.change();
+  await settle();
+  assert.equal(r.deferred.length, 2, 'both reads are in flight');
+  assert.equal(r.deferred[0].args[0].body.goal_id, undefined, 'the first asked with no goal');
+  assert.equal(r.deferred[1].args[0].body.goal_id, 77, 'the second asked with the goal picked');
+
+  r.deferred[1].release(); // the NEWER answer lands first
+  await settle(); await settle();
+  assert.match(r.el('fq-gravity').textContent, /Goal Seventy Seven/, 'the current verdict paints');
+
+  r.deferred[0].release(); // and now the older, slower one arrives
+  await settle(); await settle();
+  assert.match(r.el('fq-gravity').textContent, /Goal Seventy Seven/, 'the stale answer does not repaint the line');
+  assert.doesNotMatch(r.el('fq-gravity').textContent, /floats in the inbox/, 'the superseded verdict never reaches the builder');
+  assert.equal(r.el('fq-gravity').dataset.tone, 'lands');
+});
+
 // Every guard above was reverted and each redded its named case (RUN, and these
 // are the measured counts, not the predicted ones):
 //   drop renderGravity from the goal-change handler   -> 2 red (named-goal + filing-clears)
 //   infer from the select instead of the verdict      -> 4 red (both lies, + backlog + refusal)
-//   drop the seq guard and paint every answer         -> 0 red  <-- see below
+//   drop the seq guard and paint every answer         -> 1 red (the race case; task 1004108)
+//   make boot's `defer` never park (gate returns at once) -> 2 red (both race cases)
 //   rename the id in ideas.html                       -> 1 red (the markup pin ONLY)
 //
 // THE FIRST LINE COST A TEST FIX, and it is the reason to run these rather than
@@ -692,13 +772,22 @@ await test('filing clears the line — gravity describes a draft, and the draft
 // rendered at all. It asserts on the TEXT now. A stub's defaults can agree with
 // a broken page, which is the same lesson the markup pin below teaches twice.
 //
-// THE THIRD LINE IS AN HONEST GAP, recorded rather than papered over. The
-// out-of-order guard in refreshGravity is not covered: the fake resolves
-// synchronously, so two previews cannot interleave here and a test that removed
-// the guard would still pass. Pinning it needs a fake that delays per call,
-// which is a different harness from this one. Filed as task 1004108 rather than
-// claimed as tested — a green test over an unreachable branch would be a false
-// claim of coverage, which is the failure this file's own note above warns about.
+// THE THIRD LINE WAS AN HONEST GAP UNTIL TASK 1004108, and the shape of the fix
+// is worth keeping: the guard was not wrong, it was UNREACHABLE. Every fake here
+// was an `async` function that settled before the next call was made, so two
+// previews could never overlap and deleting `if (seq !== gravitySeq) return;`
+// redded nothing — a green suite over a branch no case could enter. `boot({
+// defer: ['preview'] })` parks a named fake's answer until the test hands it
+// back, which makes the overlap real and the guard a tested property. The FOURTH
+// line above is the guard on the guard: if `defer` ever stops parking, the race
+// case would quietly go back to testing two sequential reads, so a case asserts
+// that both calls are in flight before the ordering is asserted at all.
+//
+// `getGoalsSuggestions` is gated the same way and for the same reason, but has
+// NO case yet: `refreshGoalSuggestions` carries no sequence guard — only
+// `goalTouchedByUser` — so a test of its ordering would red against the current
+// page rather than pin it. That is a production bug to file, not a test to
+// write, and the harness is now able to reach it the day it is fixed.
 
 console.log(`\nidea_spark_hall: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/known_failing_ratchet.mjs

@@ -38,16 +38,26 @@ const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 // right all along. The apex flip removed the redirect, so the test passes and
 // the entry had to go in the same change — this file fails the suite the moment
 // a parked test starts passing.
-const MAX_KNOWN_FAILING = 1;
+//
+// Ratcheted down 1 → 0 by task 1002617, which unparked served_paths_shipped — the last
+// entry. Its own note here had PREDICTED the resolution ("whoever lands that claim should
+// re-check this assertion and remove this entry"); the claim landed (task 1002200, the
+// self-healing /docs/openapi.json endpoint) and the entry outlived it by months. That is
+// the graveyard this file exists to prevent, and it took this ratchet going red to close
+// the loop — which is the ratchet working, just later than it should have.
+//
+// AT ZERO, this file now asserts something stronger than a cap: that NOTHING is parked.
+// Parking the next failure means raising this number in the same diff, which is exactly
+// the deliberate, reviewable act it is meant to be.
+const MAX_KNOWN_FAILING = 0;
 
-const KNOWN_FAILING = {
-  served_paths_shipped: {
-    owner: 'task 1002617; collides with the ACTIVE claim "make the /docs/openapi.json endpoint self-healing"',
-    why: 'Asserts serve-internal.js reads docs/api/openapi.json. That exact path is what '
-       + 'the in-flight claim is changing, so touching it here would collide. Whoever lands '
-       + 'that claim should re-check this assertion and remove this entry.',
-  },
-};
+// EMPTY — nothing is parked, and that is the intended steady state.
+//
+// An entry here is invisible coverage: the test still runs, but its failure is expected,
+// so nobody looks at it. The last one sat for months while the very change it was waiting
+// on had already landed. If you add one, give it an owner and a concrete condition for
+// removal, and raise MAX_KNOWN_FAILING in the same diff.
+const KNOWN_FAILING = {};
 
 function runsRed(name) {
   try {

package/tests/landing_legal_pages.mjs

@@ -103,7 +103,11 @@ test('the landing page and the hub footers link privacy, terms and contact', ()
     for (const href of ['/privacy', '/terms', '/contact']) {
       assert.match(foot, new RegExp(`<a href="${href}">`), `${file}: footer links ${href}`);
     }
-    assert.match(foot, /Open source \(AGPL-3\.0\)/, `${file}: the licence link stays`);
+    // task 1003920 split one link into two: the WORDS now open the published code and the licence
+    // sits behind its own link beside it, so the claim can be checked by whoever clicks it. Both
+    // halves are asserted — a bare /Open source/ would pass again the moment the licence link went.
+    assert.match(foot, /<a href="https:\/\/www\.npmjs\.com\/package\/@bongos\/core"[^>]*>Open source<\/a>/, `${file}: the words open the actual code`);
+    assert.match(foot, /<a href="https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0\.html"[^>]*>AGPL-3\.0<\/a>/, `${file}: the licence link stays`);
     assert.match(foot, /Built by agents/, `${file}: the attribution half stays`);
   }
 });

package/tests/projects_hub_pre_uat.mjs

@@ -474,16 +474,22 @@ test('decision 9 — only mouse-driven focus on a wizard heading goes ringless',
 });
 
 test('decision 10 — both footers carry the open-source (AGPL-3.0) link, in link ink', () => {
-  const AGPL = /<a href="https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0\.html" target="_blank" rel="noopener">Open source \(AGPL-3\.0\)<\/a>\./;
+  // task 1003920 split this into TWO links: the words "Open source" open the published package and
+  // the licence sits behind its own link beside it. Both are asserted, and CODE is anchored first
+  // because it is the half 1003920 added and the half nothing else in the repo pins.
+  const CODE = /<a href="https:\/\/www\.npmjs\.com\/package\/@bongos\/core" target="_blank" rel="noopener">Open source<\/a>/;
+  const AGPL = /\(<a href="https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0\.html" target="_blank" rel="noopener">AGPL-3\.0<\/a>\)\./;
   const hubFoot = (HUB.match(/<footer class="foot">[\s\S]*?<\/footer>/) || [''])[0];
   // task 1003298: the chrome-world landing's footer is a real <footer>; the
   // pre-world page used <div class="foot">. Either element is the footer.
   const indexFoot = (INDEX.match(/<footer(?:\s[^>]*)?>[\s\S]*?<\/footer>|<div class="foot">[\s\S]*?<\/div>/) || [''])[0];
-  assert.match(hubFoot, AGPL, 'projects.html');
-  assert.match(indexFoot, AGPL, 'index.html');
-  // the link sits OUTSIDE the apex-only span, so a child instance keeps it too
-  assert.ok(hubFoot.indexOf('<!--apex-only:end-->') < hubFoot.search(AGPL), 'projects.html: after the apex-only block');
-  assert.ok(indexFoot.indexOf('<!--apex-only:end-->') < indexFoot.search(AGPL), 'index.html: after the apex-only block');
+  assert.match(hubFoot, CODE, 'projects.html: the words open the actual code');
+  assert.match(indexFoot, CODE, 'index.html: the words open the actual code');
+  assert.match(hubFoot, AGPL, 'projects.html: the licence sits beside it');
+  assert.match(indexFoot, AGPL, 'index.html: the licence sits beside it');
+  // both links sit OUTSIDE the apex-only span, so a child instance keeps them too
+  assert.ok(hubFoot.indexOf('<!--apex-only:end-->') < hubFoot.search(CODE), 'projects.html: after the apex-only block');
+  assert.ok(indexFoot.indexOf('<!--apex-only:end-->') < indexFoot.search(CODE), 'index.html: after the apex-only block');
   assert.match(COSMOS, /\.foot a\{color:var\(--link-ink\);font-weight:700;text-decoration:none;\}/, 'never the browser’s blue');
 });
 

package/tests/served_paths_shipped.mjs

@@ -47,14 +47,39 @@ const INTENTIONALLY_UNSHIPPED = {
 // module is individually allowlisted), so the base alone is not a shippable-asset claim.
 const NOT_SERVED_BASE = new Set([
   'modules', // path.join(ROOT,'modules') → MODULES_ROOT; real serves are path.join(MODULES_ROOT, key, 'public', rel)
+  // Surfaced by widening the scan to root ladders (task 1002617). tryLoadInstanceConfig
+  // does path.join(root, 'config', name) with a DYNAMIC name, and the result is READ as
+  // instance configuration — never sendFile()d to a client, so it is not a served asset
+  // and this test's premise (a served path must ship or the box 404s) does not apply.
+  // Its exclusion is also deliberate rather than an oversight: serve-internal.js:59-62
+  // records that config/ is host content under publish-manifest INSTANCE_EXCLUDE, which
+  // is exactly WHY that function walks an instance-root-first ladder. Shipping it would
+  // be the bug.
+  'config',
 ]);
 
 // Extract the leading contiguous string-literal prefix of every path.join(ROOT, ...)
 // call. A trailing non-literal arg (a variable) means "some file under this dir", so the
 // literal prefix is the directory that must ship.
+// ROOT-LADDER FORMS (task 1002617). The scan originally matched `path.join(ROOT, …)`
+// only. Task 1002200 made the OpenAPI spec self-healing and multi-rooted:
+//
+//     const roots = [...new Set([resolveDocsRoot(), ROOT])];
+//     candidates: roots.map((r) => path.join(r, 'docs/api/openapi.json'))
+//
+// so the served path stopped matching and the scan silently stopped seeing it. The
+// existence guard below is what caught that — it is the only reason this test was parked
+// rather than quietly asserting nothing, which is precisely what a self-guard is for.
+//
+// The fix is to match any single-identifier first argument, not to special-case `r`.
+// A root ladder is still a root: whichever entry wins, the file must be IN the package or
+// the standalone box 404s. Accepting any identifier does pull in non-asset bases
+// (`root + 'config'`, `ROOT + 'infra'`, `ROOT + 'modules'`); those are handled by the
+// existing NOT_SERVED_BASE / INTENTIONALLY_UNSHIPPED lists, which is what they are for,
+// and each is individually asserted by the stale-exception guard.
 function extractRootJoinPrefixes(src) {
   const out = new Set();
-  const re = /path\.join\(\s*ROOT\s*,/g;
+  const re = /path\.join\(\s*[A-Za-z_$][\w$]*\s*,/g;
   let m;
   while ((m = re.exec(src))) {
     // Arg span up to the matching close paren. These calls contain no nested parens
@@ -84,10 +109,19 @@ function probe(prefix) {
 
 const prefixes = extractRootJoinPrefixes(fs.readFileSync(SERVE_INTERNAL, 'utf8'));
 
+// THE SELF-GUARD, and it has now earned its keep once (task 1002617). A static source
+// scan degrades to silence when the code it scans changes shape: the regex stops
+// matching, `prefixes` empties, and every downstream assertion passes over nothing. That
+// is strictly worse than a red test, because it reads as coverage. This test failed for
+// months for exactly the right reason — the OpenAPI serve moved to a root ladder — and
+// it was parked in KNOWN_FAILING rather than diagnosed. Keep it, and keep it specific:
+// a bare `size > 0` would have stayed green through the very change that blinded it.
 test('extraction found the known served assets (guards against a silent no-match)', () => {
   assert.ok(prefixes.size >= 5, `expected several ROOT-served paths, found ${prefixes.size}`);
   assert.ok(prefixes.has('clients/bongos-client/bongos-client.global.js'), 'must see the client bundle read');
-  assert.ok(prefixes.has('docs/api/openapi.json'), 'must see the openapi spec read');
+  assert.ok(prefixes.has('docs/api/openapi.json'),
+    'must see the openapi spec read — it is served from a ROOT LADDER (roots.map(r => path.join(r, …))), '
+    + 'so a scan matching only `path.join(ROOT, …)` goes blind here');
 });
 
 test('every ROOT-served asset ships in the core package (isPublishable)', () => {