@bongos/core 1.19.989 → 1.19.991

package/modules/hall-ui/public/goal-map.js

@@ -27,6 +27,7 @@
   const SVGNS = 'http://www.w3.org/2000/svg';
   const kit = window.OTBKit;
   const lib = window.OTBGoalMapLib;
+  const textFit = window.OTBTextFit;
   const { escapeHtml } = window.OTB;
   const $ = (id) => document.getElementById(id);
 
@@ -47,7 +48,18 @@
 
   // ---- the map -----------------------------------------------------------------
 
-  function drawGraph(a, lay, cats) {
+  // Node text is fitted to MEASURED width, not a character count (task 1004204;
+  // the forest's fix, task 1004200). Measuring needs the svg in the document, so
+  // drawGraph collects each line into `lines` and renderGraph fits them after
+  // appending. The clipPath is the backstop for a map drawn while hidden.
+  const TEXT_X = 16;
+  function fitNodeText(lines, maxWidth) {
+    lines.forEach(({ el, full }) => {
+      el.textContent = textFit.fitText(full, maxWidth, (s) => { el.textContent = s; return el.getComputedTextLength(); });
+    });
+  }
+
+  function drawGraph(a, lay, cats, lines) {
     const svg = svgEl('svg', {
       class: 'gm-svg', viewBox: `0 0 ${lay.width} ${lay.height}`, width: lay.width, height: lay.height,
       role: 'img', 'aria-labelledby': 'gm-cap', focusable: 'false',
@@ -55,6 +67,8 @@
     const defs = svgEl('defs', {}, svg);
     const marker = svgEl('marker', { id: 'gm-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 7, markerHeight: 7, orient: 'auto' }, defs);
     svgEl('path', { class: 'gm-arrowhead', d: 'M0 0 L10 5 L0 10 z' }, marker);
+    const clip = svgEl('clipPath', { id: 'gm-text-clip' }, defs);
+    svgEl('rect', { width: lay.nodeW, height: lay.nodeH }, clip);
 
     const edges = svgEl('g', { class: 'gm-edges' }, svg);
     lay.edges.forEach((e) => {
@@ -78,9 +92,12 @@
         + ` — waits on ${lib.plural(n.depends_on || 0, 'goal')}, needed by ${lib.plural(n.depended_on_by || 0, 'goal')}`;
       svgEl('rect', { class: 'gm-card', width: p.w, height: p.h, rx: 8 }, g);
       svgEl('rect', { class: 'gm-stripe', width: 6, height: p.h, rx: 3 }, g);
-      text(g, 'gm-name', 16, 22, lib.clip(lib.displayTitle(n), lib.TITLE_CHARS));
-      text(g, 'gm-cat', 16, 38, lib.clip(cat, lib.SUB_CHARS));
-      text(g, 'gm-tasks', 16, 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`);
+      [['gm-name', 22, lib.displayTitle(n)], ['gm-cat', 38, cat], ['gm-tasks', 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`]]
+        .forEach(([cls, y, full]) => {
+          const el = text(g, cls, TEXT_X, y, full);
+          el.setAttribute('clip-path', 'url(#gm-text-clip)');
+          lines.push({ el, full });
+        });
       const trackW = p.w - 32;
       svgEl('rect', { class: 'gm-weight-track', x: 16, y: 60, width: trackW, height: 3, rx: 1.5 }, g);
       const frac = lib.weightOf(n.task_total, maxTotal);
@@ -103,7 +120,13 @@
         </figcaption>
         <div class="gm-scroll" id="gm-scroll" tabindex="0" role="region" aria-label="Goal map — scrolls sideways inside this box"></div>
       </figure>`;
-    $('gm-scroll').appendChild(drawGraph(a, lib.layout(a), cats));
+    const lay = lib.layout(a);
+    const lines = [];
+    $('gm-scroll').appendChild(drawGraph(a, lay, cats, lines));
+    const fit = () => fitNodeText(lines, lay.nodeW - 2 * TEXT_X);
+    fit();
+    // A web font that lands after the first fit changes every width.
+    if (document.fonts && document.fonts.status !== 'loaded') document.fonts.ready.then(fit);
   }
 
   function renderLegend(cats) {

package/modules/hall-ui/public/goals.html

@@ -249,6 +249,8 @@
 <!-- task 1003480: the per-goal dependency forest's pure model + layout —
      goal-map-lib.js's sibling, loaded before the renderer that draws it. -->
 <script src="/builders/goal-forest-lib.js"></script>
+<!-- tasks 1004200/1004204: measured-width title fitting, shared with the goal map. -->
+<script src="/builders/text-fit.js"></script>
 <!-- task 1003480: the forest's own drawing module — goal-map.js's sibling,
      carved out of goals-render.js to keep that file under the size ratchet.
      Loaded before goals-render.js, which calls window.OTBGoalForestRender(ctx). -->

package/modules/hall-ui/public/text-fit.js

@@ -0,0 +1,58 @@
+// text-fit.js — fit a line of text to a MEASURED width (task 1004200, shared by
+// task 1004204). Proportional glyphs vary too much for any character budget to
+// fit a fixed box, so every SVG card title is cut by its measured width instead.
+// `measure` is always the caller's (getComputedTextLength in the page, a fake in
+// tests), so this file stays DOM-free. Loaded by both the goal forest and the
+// goal map.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBTextFit = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  // The longest code-point prefix of `chars` that measures within maxWidth with
+  // `suffix` appended ('' if none does). Code points, so an emoji is never split.
+  function longestPrefix(chars, maxWidth, measure, suffix) {
+    var best = '';
+    var lo = 1;
+    var hi = chars.length;
+    while (lo <= hi) {
+      var mid = (lo + hi) >> 1;
+      var cand = chars.slice(0, mid).join('').replace(/\s+$/, '');
+      if (measure(cand + suffix) <= maxWidth) { best = cand; lo = mid + 1; } else { hi = mid - 1; }
+    }
+    return best;
+  }
+
+  // fitText — `text` whole if it fits, else its longest prefix that fits with an ellipsis.
+  function fitText(text, maxWidth, measure) {
+    var t = String(text == null ? '' : text);
+    if (measure(t) <= maxWidth) return t;
+    return longestPrefix(Array.from(t), maxWidth, measure, '…') + '…';
+  }
+
+  // fitLines — `text` wrapped at spaces into at most `maxLines` lines of maxWidth,
+  // the last ellipsised when the rest will not fit. A word wider than a whole
+  // line is broken where it runs out of room, the way the browser would.
+  function fitLines(text, maxWidth, maxLines, measure) {
+    var rest = String(text == null ? '' : text).replace(/\s+/g, ' ').trim();
+    var lines = [];
+    while (rest && lines.length < maxLines - 1 && measure(rest) > maxWidth) {
+      var words = rest.split(' ');
+      var line = '';
+      for (var i = 0; i < words.length; i++) {
+        var next = line ? line + ' ' + words[i] : words[i];
+        if (measure(next) > maxWidth) break;
+        line = next;
+      }
+      if (!line) line = longestPrefix(Array.from(words[0]), maxWidth, measure, '') || Array.from(words[0])[0];
+      lines.push(line);
+      rest = rest.slice(line.length).trim();
+    }
+    if (rest) lines.push(fitText(rest, maxWidth, measure));
+    return lines;
+  }
+
+  return { fitText: fitText, fitLines: fitLines };
+}));

package/modules/lifecycle/routes/artist-gate.js

@@ -50,7 +50,12 @@ module.exports = function buildArtistGateRouter() {
   // second guard is that the refusal must name what holds the deploy and which
   // control releases it, and a sentence assembled independently by each caller is
   // a sentence that eventually says something different. One composer, one wording.
-  router.get('/artist-gate', api.requireBuilder, async (req, res) => {
+  //
+  // A caller on this machine that reached the app DIRECTLY may also read it,
+  // without a session (task 1004205; owner decision 2026-09-23): that is how
+  // `bongos upgrade` on the box asks before moving the pin, and the box holds no
+  // builder session. Everything else still passes requireBuilder.
+  router.get('/artist-gate', unlessDirectLocalCall(api.requireBuilder), async (req, res) => {
     try {
       const gate = api.artistGate;
       const mode = gate.artistGateMode();
@@ -99,3 +104,21 @@ module.exports = function buildArtistGateRouter() {
 
   return router;
 };
+
+// A request from this machine with NO proxy hop. Public traffic always reaches
+// the app through the proxy (Caddy, behind Cloudflare), which sets a forwarding
+// header, so a loopback peer without one is a local process — the rule
+// src/bongos/metrics.js applies to its local scraper. The payload is ids, dates
+// and the policy level: nothing a process already on the box could not read.
+function isDirectLocalCall(req) {
+  const h = req.headers || {};
+  if (h['x-forwarded-for'] || h['x-real-ip'] || h.forwarded || h['cf-connecting-ip']) return false;
+  const peer = (req.socket && req.socket.remoteAddress) || '';
+  return peer === '127.0.0.1' || peer === '::1' || peer === '::ffff:127.0.0.1';
+}
+
+// Runs `requireSession` for everyone except a direct local call (above), which
+// goes straight to the handler with no builder attached.
+function unlessDirectLocalCall(requireSession) {
+  return (req, res, next) => (isDirectLocalCall(req) ? next() : requireSession(req, res, next));
+}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.989",
+  "version": "1.19.991",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.989",
+      "version": "1.19.991",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.989",
+  "version": "1.19.991",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/upgrade-artist-gate.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// scripts/gds/upgrade-artist-gate.js — the artist gate's deploy hold on the
+// UPGRADE path (task 1004205; ADR 0241).
+//
+// WHY. On a `strict` project an unresolved artist review holds the DEPLOY, never
+// the ship. Only go-live.js asked the gate, and cloudbongos.com moves its pin
+// with the vendored `upgrade.js --from` instead, so on this instance an open
+// review held nothing (2026-09-23: the gate answered holds:true and the upgrade
+// never read it). Every UI change now files such a review (owner decision
+// 2026-09-23, task 1004201), so this is where "the owner sees it before users
+// do" is actually enforced.
+//
+// It reuses go-live.js's reader and judgement verbatim, so both deploy paths
+// decide the same answer the same way: a hold or a broken gate halts, a gate
+// that cannot be read at all is a note. It asks the instance being upgraded,
+// at the origin of --health-url, because the box runs the instance it upgrades;
+// the instance answers a direct local request without a session (the route).
+// The FIRST upgrade carrying this asks an instance that still wants a session,
+// so it can only print the unread note — every upgrade after that holds.
+// Kept out of upgrade.js, which sits at the line cap.
+
+const { readArtistGate, artistGateEntries } = require('./go-live');
+
+const GATE_TIMEOUT_MS = 10_000;
+
+function unreadNote(why) {
+  return { halts: [], notes: [{ code: 'ARTIST_GATE_UNREAD', message: `could not read this instance's artist gate (${why}) — if the project runs artist_gate 'strict', an unresolved artist review may be holding this deploy and this upgrade cannot see it` }] };
+}
+
+// checkArtistGate — { halts, notes } for this instance's gate, go-live's shape.
+async function checkArtistGate({ healthUrl }, deps = {}) {
+  if (!healthUrl) return unreadNote('no --health-url to reach the instance by');
+  let origin;
+  try { origin = new URL(healthUrl).origin; } catch (_) { return unreadNote(`--health-url ${healthUrl} is not a URL`); }
+  const fetchImpl = deps.fetchImpl || fetch;
+  const call = async (method, urlPath) => {
+    const res = await fetchImpl(`${origin}${urlPath}`, { method, signal: AbortSignal.timeout(GATE_TIMEOUT_MS) });
+    let data = null;
+    try { data = await res.json(); } catch (_) { /* not JSON: readArtistGate reads it as "not a gate" */ }
+    return { status: res.status, ok: res.ok, data };
+  };
+  return artistGateEntries(await readArtistGate(call));
+}
+
+module.exports = { checkArtistGate };

package/scripts/gds/upgrade.js

@@ -5,7 +5,7 @@
 // Turns the former stub (which only ran a module-vs-core compatibility PRE-CHECK) into the real
 // channel a two-repo consumer uses to pull the Cloud Bongos core from version N to N+1:
 //
-//   pre-flight   clean git tree + module-compat vs the TARGET core version
+//   pre-flight   clean git tree + module-compat vs the TARGET core version + the artist gate (ADR 0241)
 //     → bump pin   vendor the new core .tgz, rewrite the package.json `file:` dependency
 //     → npm install  node_modules/@bongos/core becomes the new version
 //     → migrate      `npm run migrate` → the core's migrate.sh applies additive `core_*` migrations
@@ -13,13 +13,10 @@
 //     → restart      restart the instance's service so the new core is live
 //     → verify       installed package version == target (+ optional /healthz + ledger row)
 //
-// SCOPE (ADR 0100 §2, reshaped by ADR 0103 §4): the SMALLEST channel the FIRST real consumer needs
-// on its first core bump — driven by that consumer, not designed up front. That consumer is
-// emersonian-circles (task 1917): a greenfield npm-dependency instance that pins the core as
-//   "@bongos/core": "file:vendor/bongos-core-<ver>.tgz"
-// with `start`/`migrate` npm scripts and a materialized .claude/. Every step below maps to something
-// that consumer actually has. A published-registry source, rollback, and multi-consumer shapes are
-// deliberately OUT — they are follow-ups a second consumer's needs will define.
+// SCOPE (ADR 0100 §2, reshaped by ADR 0103 §4): first built for emersonian-circles (task 1917), an
+// npm-dependency instance pinning "@bongos/core": "file:vendor/bongos-core-<ver>.tgz" with
+// `start`/`migrate` npm scripts and a materialized .claude/; the registry source (ADR 0134) and
+// auto-rollback (task 2149) came later, with the consumers that needed them.
 //
 // Runs from the consumer instance root (default) or `--instance <dir>`. This script ships IN the core
 // package, so once a consumer is on core vN+1 its own `bongos upgrade` is this code. The FIRST bump
@@ -33,6 +30,7 @@ const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
 const { parseSemver, compareSemver, isStable, listAvailableVersions } = require('./update-channel');
+const { checkArtistGate } = require('./upgrade-artist-gate');
 
 const CORE_PKG = '@bongos/core';
 const ARTIFACT = 'bongos-core';
@@ -1146,13 +1144,13 @@ async function runUpgrade(opts, deps = {}) {
     else log(`  ✓ pre-flight: database${db ? ` "${db}"` : ''} reachable as the current user`);
   }
 
-  // 1b. mandatory post-restart health check (audit H9 / task 1002222, finding F5). A bump that
-  //     brings the new core live via a managed restart (--service / --restart-cmd) MUST confirm it
-  //     actually serves — an upgrade that can't be health-checked can't be reported as a success.
-  //     Enforced here in PRE-FLIGHT, before anything is mutated, so there is nothing to roll back:
-  //     if this bump will restart the service and the check isn't explicitly opted out, a
-  //     --health-url is required. (No managed restart ⇒ nothing is brought live here ⇒ the check
-  //     does not apply; the operator restarts + verifies separately.)
+  // 1a. artist gate (ADR 0241, task 1004205): an open review holds the pin, --force too; a downgrade never waits.
+  const gate = isDowngrade ? { halts: [], notes: [] } : await (deps.checkArtistGate || checkArtistGate)(opts, deps);
+  for (const n of gate.notes) err(`  ! ${n.message}`);
+  if (gate.halts.length) return { ok: false, artistGate: true, error: gate.halts.map((h) => [h.message, h.detail].filter(Boolean).join('\n    ')).join('\n') };
+  // 1b. mandatory post-restart health check (audit H9 / task 1002222, F5): a bump that restarts the
+  //     service must prove it serves, so --health-url is required up front, before anything moves.
+  //     (No managed restart ⇒ nothing is brought live here ⇒ the operator restarts + verifies.)
   const willRestart = !!(opts.service || opts.restartCmd);
   if (!dryRun && opts.healthCheck !== false && willRestart && !opts.healthUrl) {
     return { ok: false, error: 'post-restart health check is mandatory for a bump that restarts the service, but no --health-url was given.\n  Pass --health-url <url> to confirm the new core serves after restart, or --no-health-check to explicitly skip the confirmation.' };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.989'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.991'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/artist_gate_route.mjs

@@ -37,7 +37,12 @@ db.listOpenArtistReviews = async (opts) => { queries.push(opts); return { review
 
 let mode = 'strict';
 let since = null;
-api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: 'thetes' }; next(); };
+let signedIn = true;
+api.requireBuilder = (req, res, next) => {
+  if (!signedIn) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id: 7, rank: 'thetes' };
+  next();
+};
 // The route must resolve the level through the doorway's ONE reader; stubbing it
 // here is also what proves it does not read branding().project behind its back.
 api.artistGate = { ...gateModule, artistGateMode: () => mode, artistGateSince: () => since };
@@ -171,4 +176,68 @@ test('a database failure is a 500 with no internals, never a quiet "nothing hold
   db.listOpenArtistReviews = async (opts) => { queries.push(opts); return { reviews: rows, truncated: scanTruncated }; };
 });
 
+// ---- who may read it without a session (task 1004205) ---------------------------
+
+function getWith(path, headers) {
+  return new Promise((resolve, reject) => {
+    http.get(`${base}${path}`, { headers }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j }); });
+    }).on('error', reject);
+  });
+}
+
+test('the box asking its OWN instance directly reads the gate with no session — how `bongos upgrade` asks', async () => {
+  reset({ open: [review()] });
+  signedIn = false;
+  try {
+    const r = await getWith('/artist-gate', {});
+    assert.equal(r.status, 200);
+    assert.equal(r.body.holds, true);
+    assert.deepEqual(r.body.reviews, [{ id: '9001', created_at: '2026-09-12T00:00:00.000Z' }]);
+  } finally { signedIn = true; }
+});
+
+test('anything that came through a proxy still needs a session — public traffic never rides the local exception', async () => {
+  reset({ open: [review()] });
+  signedIn = false;
+  try {
+    for (const headers of [
+      { 'X-Forwarded-For': '203.0.113.9' },
+      { 'X-Real-IP': '203.0.113.9' },
+      { Forwarded: 'for=203.0.113.9' },
+      { 'CF-Connecting-IP': '203.0.113.9' },
+    ]) {
+      const r = await getWith('/artist-gate', headers);
+      assert.equal(r.status, 401, JSON.stringify(headers));
+    }
+  } finally { signedIn = true; }
+});
+
+test('a peer that is not this machine is not local, forwarding header or not — it needs a session', async () => {
+  reset({ open: [review()] });
+  signedIn = false;
+  try {
+    const out = await new Promise((resolve) => {
+      const r = { statusCode: 200 };
+      const res = {
+        status(c) { r.statusCode = c; return this; },
+        json(b) { r.body = b; resolve(r); return this; },
+        set() { return this; },
+        fail(code, o) { r.statusCode = (o && o.status) || 400; resolve(r); },
+      };
+      buildRouter().handle({ method: 'GET', url: '/artist-gate', headers: {}, socket: { remoteAddress: '203.0.113.9' } }, res, () => resolve({ statusCode: 404 }));
+    });
+    assert.equal(out.statusCode, 401);
+  } finally { signedIn = true; }
+});
+
+test('a signed-in builder behind the proxy reads it exactly as before', async () => {
+  reset({ open: [review()] });
+  const r = await getWith('/artist-gate', { 'X-Forwarded-For': '203.0.113.9' });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.holds, true);
+});
+
 test.after(() => server.close());

package/tests/goal_forest_lib.mjs

@@ -141,67 +141,6 @@ await test('describe states the numbers plainly, and an empty forest says so', (
   assert.equal(L.describe(L.analyse({})), 'No task in this goal depends on another task in this goal.');
 });
 
-// ---- fitting a title to its card (task 1004200) ------------------------------------
-
-// A proportional fake: wide capitals cost three times a narrow letter, so any
-// character budget that fits one title overflows the other.
-const WIDTHS = { W: 12, M: 11, i: 3, '…': 8, '🚀': 14 };
-const measure = (s) => Array.from(s).reduce((w, c) => w + (WIDTHS[c] ?? 6), 0);
-
-await test('fitText leaves a title that fits untouched', () => {
-  assert.equal(L.fitText('#7 Fix', 136, measure), '#7 Fix');
-});
-
-await test('fitText cuts to the MEASURED width, so wide glyphs keep fewer characters than narrow ones', () => {
-  const wide = L.fitText('W'.repeat(40), 136, measure);
-  const narrow = L.fitText('i'.repeat(80), 136, measure);
-  for (const s of [wide, narrow]) {
-    assert.ok(measure(s) <= 136, `${s} measures ${measure(s)}, past the box`);
-    assert.ok(s.endsWith('…'), 'a cut title says it was cut');
-  }
-  assert.ok(Array.from(narrow).length > 3 * Array.from(wide).length, 'no fixed character count could produce both');
-  assert.equal(wide, 'W'.repeat(10) + '…', 'the LONGEST prefix that fits: 10 W + … = 128px, 11 would be 140px');
-});
-
-await test('fitText never ends on a dangling space and never splits an emoji', () => {
-  const spaced = L.fitText('ab cd ef gh ij kl mn op qr', 62, measure);
-  assert.doesNotMatch(spaced, /\s…$/);
-  const emoji = L.fitText('🚀'.repeat(30), 60, measure);
-  assert.equal(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/.test(emoji), false, 'no lone high surrogate');
-});
-
-await test('fitText returns a bare ellipsis when not even one character fits', () => {
-  assert.equal(L.fitText('WWW', 10, measure), '…');
-});
-
-await test('fitLines keeps a short title on one line, whole', () => {
-  assert.deepEqual(L.fitLines('#7 Fix', 136, 2, measure), ['#7 Fix']);
-});
-
-await test('fitLines wraps at a space, and a second line that fits is left whole', () => {
-  assert.deepEqual(L.fitLines('aaaa bbbb cccc dddd', 60, 2, measure), ['aaaa bbbb', 'cccc dddd']);
-  assert.deepEqual(L.fitLines('a   b\n c', 60, 2, measure), ['a b c'], 'runs of whitespace read as one space');
-});
-
-await test('fitLines ellipsises the LAST line when the title outruns every line, and no line overflows', () => {
-  const lines = L.fitLines('BV1.R26 — Real governance: the constitution becomes enforceable at last', 136, 2, measure);
-  assert.equal(lines.length, 2);
-  for (const l of lines) assert.ok(measure(l) <= 136, `"${l}" measures ${measure(l)}`);
-  assert.ok(lines[1].endsWith('…'));
-  assert.ok(!lines[0].endsWith('…'), 'only the last line is cut');
-});
-
-await test('fitLines breaks a word wider than a whole line instead of overflowing, and always finishes', () => {
-  const lines = L.fitLines('W'.repeat(40), 136, 2, measure);
-  assert.deepEqual(lines, ['W'.repeat(11), 'W'.repeat(10) + '…']);
-  assert.ok(L.fitLines('WWW', 5, 2, measure).length <= 2, 'a box narrower than one glyph still terminates');
-});
-
-await test('fitLines with one line is fitText', () => {
-  const t = 'Move the remaining hall pages onto the kit';
-  assert.deepEqual(L.fitLines(t, 90, 1, measure), [L.fitText(t, 90, measure)]);
-});
-
 // ---- purity -----------------------------------------------------------------------
 
 await test('the lib is pure: no DOM, no fetch, no cross-goal input', () => {

package/tests/goal_forest_page.mjs

@@ -25,6 +25,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const LIB_JS = read('goal-forest-lib.js');
+const FIT_JS = read('text-fit.js');
 const FOREST_RENDER_JS = read('goal-forest-render.js');
 const RENDER_JS = read('goals-render.js');
 
@@ -74,6 +75,7 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(LIB_JS, sandbox, { filename: 'goal-forest-lib.js' });
+  vm.runInContext(FIT_JS, sandbox, { filename: 'text-fit.js' });
   vm.runInContext(FOREST_RENDER_JS, sandbox, { filename: 'goal-forest-render.js' });
   vm.runInContext(RENDER_JS, sandbox, { filename: 'goals-render.js' });
 

package/tests/goal_map_page.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import { makeRunner, makeEl, walk } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -27,6 +28,7 @@ const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const KIT_JS = read('hall-kit.js');
 const LIB_JS = read('goal-map-lib.js');
+const FIT_JS = read('text-fit.js');
 const PAGE_JS = read('goal-map.js');
 const PAGE_HTML = read('goal-map.html');
 const PAGE_CSS = read('goal-map.css');
@@ -52,6 +54,8 @@ async function boot(payload, { status = 200, fail = false } = {}) {
       const el = makeEl(tag);
       const orig = el.setAttribute.bind(el);
       el.setAttribute = (k, v) => { orig(k, v); if (k === 'class') el.className = String(v); if (k === 'id') el.id = String(v); };
+      // A proportional fake of SVGTextElement's measurement: a W is twice a letter.
+      if (tag === 'text') el.getComputedTextLength = () => Array.from(el.textContent).reduce((w, c) => w + (c === 'W' ? 12 : 6), 0);
       return el;
     },
   };
@@ -77,6 +81,7 @@ async function boot(payload, { status = 200, fail = false } = {}) {
   vm.createContext(sandbox);
   vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
   vm.runInContext(LIB_JS, sandbox, { filename: 'goal-map-lib.js' });
+  vm.runInContext(FIT_JS, sandbox, { filename: 'text-fit.js' });
   vm.runInContext(PAGE_JS, sandbox, { filename: 'goal-map.js' });
   await settle();
   const $ = (id) => documentObj.getElementById(id);
@@ -131,6 +136,31 @@ await test('CATEGORY IS A WORD on every drawn node, not only a colour — and "N
   assert.ok(h.$('gm-legend').textContent.includes('Modules'), 'and the legend spells each category out');
 });
 
+await test('node text is fitted to its card by MEASURED width, clipped as a backstop, and kept whole in the tooltip and table (task 1004204)', async () => {
+  const wide = 'W'.repeat(60);
+  const long = 'Agents module — framework, runtime, and the whole event router rewrite';
+  const h = await boot({
+    nodes: [node(1, { title: wide, depended_on_by: 1 }), node(2, { title: 'Fix', depends_on: 1, category: { slug: 'x', label: long } })],
+    edges: [{ from: '2', to: '1', count: 1 }],
+    counts: {},
+  });
+  const lib = createRequire(import.meta.url)(path.join(HALL, 'goal-map-lib.js'));
+  const inner = lib.layout(lib.analyse({ nodes: [node(1), node(2)], edges: [] })).nodeW - 32;
+  const texts = h.svg().querySelectorAll('.gm-node').flatMap((g) => g.querySelectorAll('text'));
+  assert.equal(texts.length, 6, 'name, category and task count on each of two nodes');
+  for (const t of texts) {
+    assert.ok(t.getComputedTextLength() <= inner, `"${t.textContent}" measures ${t.getComputedTextLength()}px, past the card's ${inner}px`);
+    assert.equal(t.getAttribute('clip-path'), 'url(#gm-text-clip)');
+  }
+  assert.ok(h.svg().querySelector('#gm-text-clip'), 'the clip the lines point at exists');
+  const names = h.svg().querySelectorAll('.gm-name').map((t) => t.textContent);
+  assert.ok(names.includes('Fix'), 'a title that fits is left whole');
+  assert.ok(names.some((n) => /^W+…$/.test(n)), 'a wide title is cut by width and says so');
+  assert.ok(h.svg().querySelectorAll('.gm-cat').some((t) => t.textContent.endsWith('…')), 'the category line is fitted too');
+  assert.ok(h.svg().querySelectorAll('title').some((x) => x.textContent.includes(wide)), 'the full title is still readable on hover');
+  assert.ok(h.$('gm-table').textContent.includes(wide), 'and in the table');
+});
+
 // ---- the split is stated, the alone goals are a list ----------------------------------
 
 await test('the stand-alone goals are a LIST, never dots, and the split is stated in the page head', async () => {
@@ -225,6 +255,7 @@ await test('the page has its h1 in static markup (so every state has one) and lo
   assert.match(PAGE_HTML, /<h1 class="page-head__h">Goal map<\/h1>/);
   assert.ok(PAGE_HTML.indexOf('goal-map-lib.js') > -1 && PAGE_HTML.indexOf('goal-map-lib.js') < PAGE_HTML.indexOf('goal-map.js'));
   assert.ok(PAGE_HTML.indexOf('hall-kit.js') < PAGE_HTML.indexOf('goal-map.js'));
+  assert.ok(PAGE_HTML.indexOf('text-fit.js') > -1 && PAGE_HTML.indexOf('text-fit.js') < PAGE_HTML.indexOf('goal-map.js'));
 });
 
 await test('it takes NO nav slot (the sky’s rule) — the Goals page is its door', () => {