@bongos/core 1.20.45 → 1.20.47

package/scripts/gds/module-artifact.js

@@ -266,4 +266,24 @@ async function verifyModuleArtifact(tgz, { key, maxBytes = MAX_TARBALL_BYTES, in
   return out;
 }
 
-module.exports = { MAX_TARBALL_BYTES, HOWTO_FILE, HOWTO_SECTIONS, packModule, verifyModuleArtifact, deniedFiles, checkHowto };
+// The how-to a published version shipped with (task 1004366): read from the version's
+// own tarball, after the same hash check install runs, so the page always shows the
+// exact file that version was published with. A version from before the gate may have
+// none (text null). Text only — nothing in the module is run or rendered here.
+// Returns { ok, text, artifactUrl, title, version, tarballSha256 } or verifyModuleArtifact's failure.
+async function readHowto(tgz, { key }) {
+  const v = await verifyModuleArtifact(tgz, { key, includeFiles: true });
+  if (!v.ok) return v;
+  const file = v.files.find((f) => f.path === HOWTO_FILE);
+  const extra = v.moduleJson.howto || {};
+  return {
+    ok: true,
+    text: file ? file.buf.toString('utf8') : null,
+    artifactUrl: extra.artifactUrl || null,
+    title: v.moduleJson.title || key,
+    version: v.version,
+    tarballSha256: v.tarballSha256,
+  };
+}
+
+module.exports = { MAX_TARBALL_BYTES, HOWTO_FILE, HOWTO_SECTIONS, packModule, verifyModuleArtifact, deniedFiles, checkHowto, readHowto };

package/scripts/gds/module.js

@@ -930,7 +930,7 @@ function storeRequest() {
   const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
   const session = readSessionToken();
   if (!session) throw new Error('no Bongos session — run `bongos setup` first');
-  return async (method, urlPath, { json, binary = false } = {}) => {
+  const call = async (method, urlPath, { json, binary = false } = {}) => {
     const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
       method,
       headers: {
@@ -946,6 +946,18 @@ function storeRequest() {
     try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
     return { ok: res.ok, status: res.status, data };
   };
+  // Where the store lives, so install can print a full link to the how-to page.
+  call.apiBase = session.apiBase;
+  return call;
+}
+
+// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
+// opened on one version. null when the version shipped without one (published
+// before ADR 0347's gate), so install never prints a link that would 404.
+function howtoLink(key, version, files, apiBase) {
+  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
+  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
+  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
 }
 
 function storeError(res) {
@@ -1093,6 +1105,8 @@ async function cmdInstall(args, {
 
   if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' }))) return 1;
   log(`\n✓ Installed "${key}" ${got.described.version}. It is not switched on: enable it from the hall's Modules tab when you want it.`);
+  const howto = howtoLink(key, got.described.version, got.verified.files, call.apiBase);
+  if (howto) log(`  How to use it: ${howto}`);
   return 0;
 }
 

package/scripts/hall-preview/server.js

@@ -144,6 +144,9 @@ const FIXTURE_FALLBACKS = [
   // the Approval queue's renders (task 1004323): a round's named visuals, one
   // fixture for any task id, as the editor read above serves any page.
   [/^tasks\/\d+\/visuals$/, 'tasks__visuals'],
+  // a store version's how-to page (task 1004366): one reading serves any key and
+  // version, since the Modules tab's how-to view shows one document.
+  [/^store\/modules\/[a-z0-9-]+\/versions\/[^/]+\/howto$/, 'store__modules__howto'],
 ];
 
 // CANNED WRITES (task 1004321). The tweak editor's whole flow is writes (the

package/src/bongos/module-store.js

@@ -179,6 +179,35 @@ async function resolveAcquirable(key, { version = null, db } = {}) {
   return { ok: true, module: mod, version: row, price: price || null, free: isFreePrice(price) };
 }
 
+// Resolve ONE exact version for reading its how-to (task 1004366). Unlike
+// resolveAcquirable this does not refuse a delisted module: ADR 0338 D2 keeps a
+// delisted module readable for the people who already hold it, so it hands the
+// caller the module's status and the route decides who may read on.
+// Returns { ok: true, module, version } or { ok: false, status, code, message }.
+async function resolveReadable(key, version, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const refuse = (status, code, message) => ({ ok: false, status, code, message });
+  const { rows: [mod] } = await pool.query(
+    'SELECT module_key, title, author_id, status FROM store_modules WHERE module_key = $1', [key]);
+  if (!mod) return refuse(404, 'module_not_found', `The store has no module "${key}".`);
+  const { rows: [row] } = await pool.query(
+    `SELECT id, module_key, version, tarball_sha256, artifact_path, published_at
+       FROM store_module_versions WHERE module_key = $1 AND version = $2`, [key, version]);
+  if (!row) return refuse(404, 'version_not_found', `"${key}" has no published version ${version}.`);
+  return { ok: true, module: mod, version: row };
+}
+
+// Which of these (key, version) pairs are published store versions, as a Set of
+// "key@version" — so the hall's Modules tab can link an installed module's how-to
+// (task 1004366). One query for the whole list.
+async function publishedVersionSet(keys, { db } = {}) {
+  if (!keys.length) return new Set();
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    'SELECT module_key, version FROM store_module_versions WHERE module_key = ANY($1)', [keys]);
+  return new Set(rows.map((r) => `${r.module_key}@${r.version}`));
+}
+
 // The tarball on disk for a version row. artifact_path is relative to the store dir
 // (relativeArtifactPath), and artifactPath() re-validates key + version, so a row
 // can never point a read outside the store.
@@ -192,5 +221,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  isFreePrice, resolveAcquirable, versionArtifactFile,
+  isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, versionArtifactFile,
 };

package/src/bongos/routes/modules.js

@@ -32,6 +32,9 @@
 //                               the server end of `bongos module install` (task
 //                               1003785): take the entitlement, download the
 //                               checked tarball, record the version placed.
+//   GET  /store/modules/:key/versions/:version/howto
+//                               the HOWTO.md that version shipped with, as text for
+//                               the hall's how-to page (task 1004366, ADR 0347).
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -78,7 +81,7 @@ const moduleArtifact = require('../../../scripts/gds/module-artifact');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  resolveAcquirable, versionArtifactFile,
+  resolveAcquirable, resolveReadable, publishedVersionSet, versionArtifactFile,
 } = require('../module-store');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
@@ -146,8 +149,20 @@ function listModules() {
   });
 }
 
+// How many checked how-tos one router keeps in memory (task 1004366). Each is one
+// module's HOWTO.md text, so a few hundred is well under a megabyte; past the cap
+// the oldest entry is dropped.
+const HOWTO_CACHE_MAX = 200;
+
 module.exports = function buildModulesRouter() {
   const router = express.Router();
+  // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
+  // router starts empty.
+  const howtoCache = new Map();
+  const rememberHowto = (k, v) => {
+    howtoCache.set(k, v);
+    if (howtoCache.size > HOWTO_CACHE_MAX) howtoCache.delete(howtoCache.keys().next().value);
+  };
 
   // rank: any-builder — list every on-disk module with attribution + provenance (same read gate as the atlas/primer pages).
   router.get('/modules', auth.requireBuilder, asyncHandler('GET /modules', async (_req, res) => {
@@ -160,11 +175,22 @@ module.exports = function buildModulesRouter() {
     const sources = (resolvedSet && resolvedSet.sources) || {};
     const overrideRows = await listOverrides();
     const byKey = new Map(overrideRows.map((r) => [r.module_key, r]));
+    // Which on-disk modules are a published store version, so the row can link that
+    // version's how-to page (task 1004366). Failure-tolerant like the override read:
+    // a store that cannot be read costs the link, never the tab.
+    let published = new Set();
+    try { published = await publishedVersionSet(all.map((m) => m.key)); }
+    catch (e) { log.warn({ err: e.message }, 'store versions unreadable for the modules list'); }
     for (const m of all) {
       m.enabled_source = sources[m.key] || 'default';
       m.override = byKey.has(m.key)
         ? { enabled: byKey.get(m.key).enabled, set_by: byKey.get(m.key).set_by_login || null, set_at: byKey.get(m.key).set_at }
         : null;
+      // Only a module in THIS instance's tree: install places store modules there, so
+      // a core-shipped module that happens to share a store key@version never links.
+      m.store_howto = m.source === 'instance' && m.version && published.has(`${m.key}@${m.version}`)
+        ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
+        : null;
     }
     res.json({
       modules: all,
@@ -475,6 +501,70 @@ module.exports = function buildModulesRouter() {
       res.send(buf);
     }));
 
+  // GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version
+  // shipped with (task 1004366, ADR 0347 D1/D3), read from that version's own stored
+  // tarball after the install hash check, so it always matches the version and cannot
+  // change after publishing. Returns the markdown as TEXT, never HTML: the hall's
+  // Modules tab renders it through its one escaping markdown reader (md-reader.js),
+  // because the file is author-written and must be treated as untrusted input.
+  //
+  // rank: any-builder — no entitlement needed, since a buyer reads the how-to before
+  // deciding. The one exception is a delisted module: ADR 0338 D2 keeps it readable
+  // only for the people who already hold it, so there the caller's own entitlement
+  // is checked (own-scoped, like the reads above).
+  router.get('/store/modules/:key/versions/:version/howto', auth.requireBuilder,
+    asyncHandler('GET /store/modules/:key/versions/:version/howto', async (req, res) => {
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const delisted = r.module.status === 'delisted';
+      if (delisted) {
+        const held = await checkEntitlement({ moduleKey: key, holderKind: 'builder', holderRef: String(req.builder.id) });
+        if (!held.entitled) {
+          return res.fail('module_delisted', { status: 409, message: `"${key}" is delisted: its how-to stays readable only for people who already hold it (ADR 0338 D2).` });
+        }
+      }
+      // A published version never changes, so its checked how-to is cached by the
+      // tarball hash the registry holds: the inflate + hash check runs once per
+      // version per process, not on every page view.
+      const cacheKey = `${key}@${version}:${r.version.tarball_sha256}`;
+      let h = howtoCache.get(cacheKey);
+      if (!h) {
+        let buf;
+        try { buf = await fs.promises.readFile(versionArtifactFile(r.version)); }
+        catch (e) {
+          log.error({ key, version, err: e.message }, 'store tarball missing');
+          return res.fail('artifact_missing', { status: 500, message: `The store has no file for ${key} ${version}.` });
+        }
+        h = await moduleArtifact.readHowto(buf, { key });
+        if (!h.ok) {
+          log.error({ key, version, code: h.code }, 'stored tarball failed verification');
+          return res.fail('artifact_invalid', { status: 500, message: `The stored file for ${key} ${version} did not pass its hash check.` });
+        }
+        if (h.tarballSha256 !== r.version.tarball_sha256) {
+          log.error({ key, version }, 'stored tarball is not the one the registry recorded');
+          return res.fail('artifact_invalid', { status: 500, message: `The stored file for ${key} ${version} is not the one that was published.` });
+        }
+        rememberHowto(cacheKey, h);
+      }
+      if (h.text == null) {
+        return res.fail('howto_missing', { status: 404, message: `${key} ${version} was published before every module shipped a how-to, so it has none.` });
+      }
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        module_key: key,
+        title: h.title,
+        version: h.version,
+        published_at: r.version.published_at,
+        delisted,
+        markdown: h.text,
+        artifact_url: h.artifactUrl,
+      });
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.45'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.47'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/bulk_toolbar.mjs

@@ -0,0 +1,202 @@
+// tests/bulk_toolbar.mjs — the hall's shared bulk toolbar (task 1003141).
+//
+// One toolbar, two boards: /work and the goal board build the SAME one from
+// modules/hall-ui/public/bulk-toolbar.js. This runs the real module (it is
+// node-require-safe) against a stub page, so what it proves is behaviour — a
+// release selection really enables Bulk release, a cycle really disables the
+// sequential prompt — rather than that two files agree on a spelling.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(import.meta.dirname, '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
+const { topoOrder, buildBulkParallelPrompt, buildBulkSequentialPrompt, makeBulkToolbar } = require(path.join(PUB, 'bulk-toolbar.js'));
+
+const loc = { hostname: 'builders.example.com', origin: 'https://builders.example.com' };
+
+test('topoOrder puts a dependency first and ignores edges outside the selection', () => {
+  const edges = new Map([[2, [1]], [1, [99]], [3, []]]);
+  const order = topoOrder([2, 1, 3], edges);
+  assert.ok(order.indexOf(1) < order.indexOf(2), 'a dependency precedes its dependent');
+  assert.equal(order.length, 3);
+});
+
+test('topoOrder answers null for a cycle', () => {
+  assert.equal(topoOrder([1, 2], new Map([[1, [2]], [2, [1]]])), null);
+});
+
+test('the prompts name every task and the hall link', () => {
+  const tasks = [{ id: 5, title: 'Five' }, { id: 6, title: 'Six' }];
+  const par = buildBulkParallelPrompt(tasks, loc);
+  assert.match(par, /2 Bongos tasks IN PARALLEL/);
+  assert.match(par, /Session 2 — task 6 \(Six\) — https:\/\/builders\.example\.com#\/task\/6/);
+  const seq = buildBulkSequentialPrompt(tasks, { hostname: 'example.com', origin: 'https://example.com' });
+  assert.match(seq, /IN ORDER/);
+  assert.match(seq, /1\. Task 5 \(Five\) — https:\/\/example\.com\/builders#\/task\/5/);
+});
+
+// --- the factory, against a stub page --------------------------------------
+
+function stubPage(present) {
+  const els = {};
+  for (const id of present) els[id] = { hidden: true, disabled: false, textContent: '', title: '', listeners: {}, addEventListener(t, fn) { this.listeners[t] = fn; } };
+  globalThis.document = { getElementById: (id) => els[id] || null };
+  globalThis.window = { confirm: () => true };
+  globalThis.location = loc;
+  return els;
+}
+
+function build(els, over = {}) {
+  const calls = { claimMany: [], releaseMany: [], copied: [], toasts: [] };
+  const selection = { claim: new Set(), release: new Map() };
+  const tasks = new Map([[1, { id: 1, title: 'One' }], [2, { id: 2, title: 'Two' }]]);
+  const bar = makeBulkToolbar({
+    ids: { bar: 'bar', count: 'count', claim: 'claim', release: 'release', parallel: 'parallel', sequential: 'sequential', clear: 'clear' },
+    selection,
+    findTask: (id) => tasks.get(id),
+    claimAction: {
+      validateMany: async () => ({ ok: true, parallelSafe: true, byId: new Map() }),
+      claimMany: async (ids) => { calls.claimMany.push(ids); return { ok: true }; },
+      releaseMany: async (e) => { calls.releaseMany.push(e); return { ok: true }; },
+    },
+    getJSON: async () => ({ task: { dependencies: [] } }),
+    API: '/api/bongos',
+    copyText: async (t) => { calls.copied.push(t); return true; },
+    toast: (m) => calls.toasts.push(m),
+    curLabel: () => 'credits',
+    describeReason: (r) => r,
+    onClear: () => { calls.cleared = true; },
+    ...over,
+  });
+  return { bar, selection, calls };
+}
+const settle = () => new Promise((r) => setTimeout(r, 1000));
+
+test('nothing selected hides the bar', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar } = build(els);
+  els.bar.hidden = false;
+  bar.render();
+  assert.equal(els.bar.hidden, true);
+});
+
+test('a release selection alone enables Bulk release and leaves claim off', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection } = build(els);
+  selection.release.set('77', '9');
+  bar.render();
+  assert.equal(els.bar.hidden, false);
+  assert.equal(els.count.textContent, '1 to release');
+  assert.equal(els.release.disabled, false);
+  assert.equal(els.claim.disabled, true);
+});
+
+test('two ready tasks enable both prompts once the checks come back, and the prompts copy', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.claim.add('2');
+  bar.render();
+  assert.equal(els.parallel.disabled, true, 'disabled while the dry run is pending');
+  await settle();
+  assert.equal(els.parallel.disabled, false);
+  assert.equal(els.sequential.disabled, false);
+  assert.equal(els.claim.textContent, 'Bulk claim (2)');
+  bar.wire();
+  await els.parallel.listeners.click();
+  await els.sequential.listeners.click();
+  assert.equal(calls.copied.length, 2);
+  assert.match(calls.copied[0], /IN PARALLEL/);
+  assert.match(calls.copied[1], /IN ORDER/);
+});
+
+test('a dependency cycle disables the sequential prompt with the reason', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const edges = { 1: [2], 2: [1] };
+  const { bar, selection } = build(els, { getJSON: async (p) => ({ task: { dependencies: edges[Number(p.split('/').pop())].map((id) => ({ id })) } }) });
+  selection.claim.add('1'); selection.claim.add('2');
+  bar.render();
+  await settle();
+  assert.equal(els.sequential.disabled, true);
+  assert.match(els.sequential.title, /cycle/);
+});
+
+test('a page without the optional buttons simply has no such feature', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'clear']);
+  const { bar, selection } = build(els);
+  selection.claim.add('1'); selection.claim.add('2');
+  assert.doesNotThrow(() => bar.render());
+  assert.doesNotThrow(() => bar.wire());
+  assert.equal(els.claim.textContent, 'Bulk claim (2)');
+});
+
+test('Bulk claim and Bulk release go through the shared action and empty their selection', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.release.set('77', '9');
+  bar.wire();
+  await els.claim.listeners.click();
+  assert.deepEqual(calls.claimMany, [[1]]);
+  assert.equal(selection.claim.size, 0);
+  await els.release.listeners.click();
+  assert.deepEqual(calls.releaseMany, [[['77', '9']]]);
+  assert.equal(selection.release.size, 0);
+});
+
+test('Clear empties both selections and lets the page repaint its cards', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.release.set('77', '9');
+  bar.clearSelection();
+  assert.equal(selection.claim.size + selection.release.size, 0);
+  assert.equal(calls.cleared, true);
+  assert.equal(els.bar.hidden, true);
+});
+
+// --- the two boards use it, and neither keeps a private copy -----------------
+
+test('both boards build the shared toolbar and carry all five buttons', () => {
+  const work = read('work.html');
+  const goals = read('goals.html');
+  for (const k of ['claim', 'release', 'parallel', 'sequential', 'clear']) {
+    assert.match(work, new RegExp(`id="bulk-${k}-btn"`), `work.html has bulk-${k}-btn`);
+    assert.match(goals, new RegExp(`id="goal-bulk-${k}-btn"`), `goals.html has goal-bulk-${k}-btn`);
+  }
+  assert.match(read('work.js'), /OTBBulkToolbar\.makeBulkToolbar\(/);
+  assert.match(read('goals-render.js'), /OTBBulkToolbar\.makeBulkToolbar\(/);
+  for (const [page, scripts] of [['work.html', ['bulk-toolbar.js', 'work.js']], ['goals.html', ['bulk-toolbar.js', 'goals-render.js']]]) {
+    const html = read(page);
+    const at = (n) => html.indexOf(`src="/builders/${n}`);
+    assert.ok(at(scripts[0]) > -1 && at(scripts[0]) < at(scripts[1]), `${page}: bulk-toolbar.js loads before ${scripts[1]}`);
+  }
+});
+
+test('no board keeps a private copy of the toolbar logic', () => {
+  for (const f of ['work.js', 'goals-page.js', 'goals-render.js']) {
+    const src = read(f);
+    assert.doesNotMatch(src, /function topoOrder|function buildBulk(Parallel|Sequential)Prompt|function scheduleValidate|function doBulk(Claim|Release)|function doGoalBulkClaim/, `${f} re-grew toolbar logic`);
+  }
+});
+
+test('the goal board offers a release checkbox on the viewer\'s own cards, and it styles', () => {
+  const render = read('goals-render.js');
+  assert.match(render, /class="wip__select" data-claim-id=/, 'a mine-active card carries the release checkbox');
+  assert.match(read('goals-page.js'), /closest\('\.task__select, \.wip__select'\)/, 'the card list listens for it');
+  assert.match(read('style.css'), /\n\.wip__select \{/, '.wip__select is in the shared sheet the goal board loads');
+});
+
+test('goals.html no longer borrows work.css, and work.css no longer holds what it lent', () => {
+  assert.doesNotMatch(read('goals.html'), /work\.css/, 'the goal board is off the board-only sheet');
+  const work = read('work.css');
+  for (const sel of ['.claim-count-line', '.wip__release', '.wip__select']) {
+    assert.ok(!new RegExp(`^${sel.replace('.', '\\.')}(\\s|:|,|\\{)`, 'm').test(work), `work.css must not restate ${sel}`);
+  }
+  const style = read('style.css');
+  for (const sel of ['.claim-count-line', '.wip__release', '.wip__select']) {
+    assert.ok(new RegExp(`^${sel.replace('.', '\\.')} \\{`, 'm').test(style), `style.css carries ${sel}`);
+  }
+});

package/tests/claim_action.mjs

@@ -264,8 +264,8 @@ await test('both boards CONSTRUCT the shared action, not just its error text', (
 
 await test('every claim/release entry point routes through it', () => {
   const sites = {
-    'work.js': ['doClaim', 'doRelease', 'doBulkClaim', 'doBulkRelease'],
-    'goals-page.js': ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim'],
+    'work.js': ['doClaim', 'doRelease'],
+    'goals-page.js': ['doGoalClaim', 'doGoalRelease'],
   };
   for (const [f, fns] of Object.entries(sites)) {
     const src = read('modules', 'hall-ui', 'public', f);
@@ -278,6 +278,15 @@ await test('every claim/release entry point routes through it', () => {
         `${f}: ${fn} still maps its own refusal`);
     }
   }
+  // Both boards' BULK claim/release live in the shared toolbar now (task 1003141),
+  // built over the same action — so the same rule is checked there, once.
+  const bulk = read('modules', 'hall-ui', 'public', 'bulk-toolbar.js');
+  for (const fn of ['doBulkClaim', 'doBulkRelease']) {
+    const m = bulk.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n    \\}`));
+    assert.ok(m, `bulk-toolbar.js: ${fn} not found`);
+    assert.match(m[0], /claimAction\.(claimMany|releaseMany)\(/, `bulk-toolbar.js: ${fn} does not go through the shared action`);
+    assert.doesNotMatch(m[0], /friendlyClaimError\(/, `bulk-toolbar.js: ${fn} maps its own refusal`);
+  }
 });
 
 await test('no call site reloads on top of the action\'s own refresh', async () => {
@@ -287,7 +296,7 @@ await test('no call site reloads on top of the action\'s own refresh', async ()
   // twice. work.js's doBulkClaim is the correct shape: redraw the toolbar,
   // never re-fetch. A finally that awaits a loader is the tell.
   const src = read('modules', 'hall-ui', 'public', 'goals-page.js');
-  for (const fn of ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim']) {
+  for (const fn of ['doGoalClaim', 'doGoalRelease']) {
     const m = src.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n  \\}`));
     assert.ok(m, `${fn} not found`);
     assert.doesNotMatch(m[0], /finally \{[\s\S]*?await loadGoalTasks\(/,
@@ -393,7 +402,7 @@ await test('the cache-bust moved on every page whose script changed', () => {
   ]) {
     const html = read('modules', 'hall-ui', 'public', page);
     for (const s of scripts) {
-      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-26-claimaction1'), `${page}: ${s} not busted`);
+      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-30-bulktoolbar'), `${page}: ${s} not busted`);
     }
   }
 });

package/tests/goal_category_ui.mjs

@@ -126,6 +126,7 @@ async function renderList() {
   // task 1003458: the page loads claim-action.js before this script; the stub
   // must mirror that, or the destructure of window.OTBClaimAction throws.
   vm.runInContext(read('modules/hall-ui/public/claim-action.js'), sandbox, { filename: 'claim-action.js' });
+  vm.runInContext(read('modules/hall-ui/public/bulk-toolbar.js'), sandbox, { filename: 'bulk-toolbar.js' }); // task 1003141
   vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });

package/tests/goal_criterion_confirm_ui.mjs

@@ -157,6 +157,8 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   // must mirror that, or the destructure of window.OTBClaimAction throws.
   vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/claim-action.js'), 'utf8'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
+  // task 1003141: goals-render.js builds the shared bulk toolbar at boot.
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/bulk-toolbar.js'), 'utf8'), sandbox, { filename: 'bulk-toolbar.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });
   vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });

package/tests/goal_forest_page.mjs

@@ -80,6 +80,7 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
   // task 1003458: the page loads claim-action.js before this script; the stub
   // must mirror that, or the destructure of window.OTBClaimAction throws.
   vm.runInContext(read('claim-action.js'), sandbox, { filename: 'claim-action.js' });
+  vm.runInContext(read('bulk-toolbar.js'), sandbox, { filename: 'bulk-toolbar.js' }); // task 1003141
   vm.runInContext(RENDER_JS, sandbox, { filename: 'goals-render.js' });
 
   const state = { current: 7, forest: null, forestError: false };

package/tests/goal_invite_consent.mjs

@@ -171,7 +171,7 @@ function harness({ pendingRequests = [] } = {}) {
   vm.createContext(sandbox);
   // task 1003458: claim-action.js sits between task-lib and goals-render on the
   // real page (goals.html); the stub mirrors that order.
-  for (const f of ['hall-kit.js', 'task-lib.js', 'claim-action.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
+  for (const f of ['hall-kit.js', 'task-lib.js', 'claim-action.js', 'bulk-toolbar.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
     vm.runInContext(read(P + f), sandbox, { filename: f });
   }
 

package/tests/goal_mine_lens.mjs

@@ -150,6 +150,7 @@ async function boot({
   // task 1003458: the page loads claim-action.js before this script; the stub
   // must mirror that, or the destructure of window.OTBClaimAction throws.
   vm.runInContext(hall('claim-action.js'), sandbox, { filename: 'claim-action.js' });
+  vm.runInContext(hall('bulk-toolbar.js'), sandbox, { filename: 'bulk-toolbar.js' }); // task 1003141
   vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
   vm.runInContext(GOALS_PAGE_SRC, sandbox, { filename: 'goals-page.js' });
   for (let i = 0; i < 30; i += 1) await new Promise((r) => setTimeout(r, 0));

package/tests/hall_board_world.mjs

@@ -80,7 +80,7 @@ test('.task IS the panel — --bg-card at the full radius, with no drawn edge at
 // gets missed: "Git" came back 17x24 after a height-only fix.
 for (const sel of ['.task__select', '.wip__select']) {
   test(`${sel} is a 24px target with a 14px drawn box`, () => {
-    const css = sel.includes('wip') ? workCss : styleCss;
+    const css = styleCss; // .wip__select joined .task__select here when the goal board borrowed it (task 1003141)
     const box = rule(css, sel);
     assert.ok(box, `${sel} has a rule`);
     assert.match(box, /width:\s*24px/, 'the HIT AREA is 24px — this is what the floor measures');

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}<\/div>/, 'provenance, credit and upkeep are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}<\/div>/, 'provenance, credit, upkeep and (for a store version, task 1004366) the how-to link are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/hall_mine_lens.mjs

@@ -204,6 +204,7 @@ function bootWorkBoard({ signedIn = true, goalsFail = false } = {}) {
   // task 1003458: the page loads claim-action.js before this script; the stub
   // must mirror that, or the destructure of window.OTBClaimAction throws.
   vm.runInContext(fs.readFileSync(path.join(HALL, 'claim-action.js'), 'utf8'), sandbox, { filename: 'claim-action.js' });
+  vm.runInContext(fs.readFileSync(path.join(HALL, 'bulk-toolbar.js'), 'utf8'), sandbox, { filename: 'bulk-toolbar.js' }); // task 1003141
   vm.runInContext(WORK_JS, sandbox, { filename: 'work.js' });
   (documentObj.listeners.DOMContentLoaded || []).forEach((fn) => fn());