@bongos/core 1.20.46 → 1.20.48

package/modules/ui-design/kit/serve.js

@@ -277,7 +277,9 @@ function fileUnder(base, rel) {
 // is absolutised to this origin per request.
 const AVATAR_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64"><circle cx="32" cy="32" r="32" fill="#888"/><circle cx="32" cy="26" r="11" fill="#ddd"/><path d="M12 56c3-12 11-17 20-17s17 5 20 17" fill="#ddd"/></svg>';
 function me(origin) {
-  const m = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'me.json'), 'utf8'));
+  // stub.fixtures may re-point the identity too (task 1004422: the founding-mode render) —
+  // the same ALIAS every other fixture honours, so a variant states file needs no stub code.
+  const m = JSON.parse(fs.readFileSync(path.join(FIXTURES, (ALIAS.me || 'me') + '.json'), 'utf8'));
   if (m.builder && typeof m.builder.avatar_url === 'string' && m.builder.avatar_url.startsWith('/')) m.builder.avatar_url = origin + m.builder.avatar_url;
   return m;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.46",
+  "version": "1.20.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.46",
+      "version": "1.20.48",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.46",
+  "version": "1.20.48",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8389,5 +8389,17 @@
       "id": "1004366",
       "text": "Every store module version now has a readable how-to page in the hall, with a Save as PDF button and an optional link to a Claude page."
     }
+  ],
+  "1.20.47": [
+    {
+      "id": "1003141",
+      "text": "The Goals page now has the same bulk actions as the Tasks board: claim several tasks, release your own, or copy a prompt to work them in parallel or in order. Both pages now share one toolbar, so they stay in step."
+    }
+  ],
+  "1.20.48": [
+    {
+      "id": "1004422",
+      "text": "While a new project is being founded, its builders hall now shows a clear \"project founding mode\" band at the top and dims the rooms that open later. A hall that isn't being founded stays exactly as it was."
+    }
   ]
 }

package/src/bongos/routes/me.js

@@ -187,7 +187,7 @@ module.exports = function buildMeRouter() {
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
-      navPermissions,
+      navPermissions, foundingMode,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -308,6 +308,16 @@ module.exports = function buildMeRouter() {
       // Same fan-out slot as the reads above, but it fails CLOSED rather than
       // open — null hides the link. See navPermissionsFor.
       navPermissionsFor(req.builder.id),
+      // task 1004422 (BV2.PS03): PROJECT FOUNDING MODE — is this project still being
+      // founded, and at which genesis stage. Same fan-out slot and posture as social
+      // mode: null (not founding, or unreadable) is OFF, and the hall then renders
+      // exactly as it does today, which is the owner's no-hijack condition.
+      (async () => {
+        try {
+          if (!onboarding || !onboarding.foundingModeFor) return null;
+          return await onboarding.foundingModeFor();
+        } catch (_) { return null; }
+      })(),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -378,6 +388,13 @@ module.exports = function buildMeRouter() {
       // when lifecycle is disabled or the read failed, and the shell treats null
       // as OFF — a mode that cannot be read is not on.
       social: socialMode,
+      // task 1004422 (BV2.PS03, goal 1000121): PROJECT FOUNDING MODE. Genesis is a
+      // mode the EXISTING hall wears (the blend rule, docs/design/project-startup-
+      // direction.md), so it rides /me exactly like social: the shell stamps
+      // html[data-founding], draws the founding band and dims the rooms still asleep.
+      // Shape: { active, stage, stage_number, stage_count, day, asleep: {navId: stage} },
+      // or null — and null is OFF, the hall as today.
+      founding_mode: foundingMode,
       // task 1003744: { '<atom>': boolean } for each permission key a hall nav
       // item may gate on (NAV_PERMISSION_ATOMS above), so an item can declare the
       // SAME atom its page is gated on instead of borrowing the nearest rank

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.48'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/bulk_toolbar.mjs

@@ -0,0 +1,202 @@
+// tests/bulk_toolbar.mjs — the hall's shared bulk toolbar (task 1003141).
+//
+// One toolbar, two boards: /work and the goal board build the SAME one from
+// modules/hall-ui/public/bulk-toolbar.js. This runs the real module (it is
+// node-require-safe) against a stub page, so what it proves is behaviour — a
+// release selection really enables Bulk release, a cycle really disables the
+// sequential prompt — rather than that two files agree on a spelling.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(import.meta.dirname, '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
+const { topoOrder, buildBulkParallelPrompt, buildBulkSequentialPrompt, makeBulkToolbar } = require(path.join(PUB, 'bulk-toolbar.js'));
+
+const loc = { hostname: 'builders.example.com', origin: 'https://builders.example.com' };
+
+test('topoOrder puts a dependency first and ignores edges outside the selection', () => {
+  const edges = new Map([[2, [1]], [1, [99]], [3, []]]);
+  const order = topoOrder([2, 1, 3], edges);
+  assert.ok(order.indexOf(1) < order.indexOf(2), 'a dependency precedes its dependent');
+  assert.equal(order.length, 3);
+});
+
+test('topoOrder answers null for a cycle', () => {
+  assert.equal(topoOrder([1, 2], new Map([[1, [2]], [2, [1]]])), null);
+});
+
+test('the prompts name every task and the hall link', () => {
+  const tasks = [{ id: 5, title: 'Five' }, { id: 6, title: 'Six' }];
+  const par = buildBulkParallelPrompt(tasks, loc);
+  assert.match(par, /2 Bongos tasks IN PARALLEL/);
+  assert.match(par, /Session 2 — task 6 \(Six\) — https:\/\/builders\.example\.com#\/task\/6/);
+  const seq = buildBulkSequentialPrompt(tasks, { hostname: 'example.com', origin: 'https://example.com' });
+  assert.match(seq, /IN ORDER/);
+  assert.match(seq, /1\. Task 5 \(Five\) — https:\/\/example\.com\/builders#\/task\/5/);
+});
+
+// --- the factory, against a stub page --------------------------------------
+
+function stubPage(present) {
+  const els = {};
+  for (const id of present) els[id] = { hidden: true, disabled: false, textContent: '', title: '', listeners: {}, addEventListener(t, fn) { this.listeners[t] = fn; } };
+  globalThis.document = { getElementById: (id) => els[id] || null };
+  globalThis.window = { confirm: () => true };
+  globalThis.location = loc;
+  return els;
+}
+
+function build(els, over = {}) {
+  const calls = { claimMany: [], releaseMany: [], copied: [], toasts: [] };
+  const selection = { claim: new Set(), release: new Map() };
+  const tasks = new Map([[1, { id: 1, title: 'One' }], [2, { id: 2, title: 'Two' }]]);
+  const bar = makeBulkToolbar({
+    ids: { bar: 'bar', count: 'count', claim: 'claim', release: 'release', parallel: 'parallel', sequential: 'sequential', clear: 'clear' },
+    selection,
+    findTask: (id) => tasks.get(id),
+    claimAction: {
+      validateMany: async () => ({ ok: true, parallelSafe: true, byId: new Map() }),
+      claimMany: async (ids) => { calls.claimMany.push(ids); return { ok: true }; },
+      releaseMany: async (e) => { calls.releaseMany.push(e); return { ok: true }; },
+    },
+    getJSON: async () => ({ task: { dependencies: [] } }),
+    API: '/api/bongos',
+    copyText: async (t) => { calls.copied.push(t); return true; },
+    toast: (m) => calls.toasts.push(m),
+    curLabel: () => 'credits',
+    describeReason: (r) => r,
+    onClear: () => { calls.cleared = true; },
+    ...over,
+  });
+  return { bar, selection, calls };
+}
+const settle = () => new Promise((r) => setTimeout(r, 1000));
+
+test('nothing selected hides the bar', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar } = build(els);
+  els.bar.hidden = false;
+  bar.render();
+  assert.equal(els.bar.hidden, true);
+});
+
+test('a release selection alone enables Bulk release and leaves claim off', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection } = build(els);
+  selection.release.set('77', '9');
+  bar.render();
+  assert.equal(els.bar.hidden, false);
+  assert.equal(els.count.textContent, '1 to release');
+  assert.equal(els.release.disabled, false);
+  assert.equal(els.claim.disabled, true);
+});
+
+test('two ready tasks enable both prompts once the checks come back, and the prompts copy', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.claim.add('2');
+  bar.render();
+  assert.equal(els.parallel.disabled, true, 'disabled while the dry run is pending');
+  await settle();
+  assert.equal(els.parallel.disabled, false);
+  assert.equal(els.sequential.disabled, false);
+  assert.equal(els.claim.textContent, 'Bulk claim (2)');
+  bar.wire();
+  await els.parallel.listeners.click();
+  await els.sequential.listeners.click();
+  assert.equal(calls.copied.length, 2);
+  assert.match(calls.copied[0], /IN PARALLEL/);
+  assert.match(calls.copied[1], /IN ORDER/);
+});
+
+test('a dependency cycle disables the sequential prompt with the reason', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const edges = { 1: [2], 2: [1] };
+  const { bar, selection } = build(els, { getJSON: async (p) => ({ task: { dependencies: edges[Number(p.split('/').pop())].map((id) => ({ id })) } }) });
+  selection.claim.add('1'); selection.claim.add('2');
+  bar.render();
+  await settle();
+  assert.equal(els.sequential.disabled, true);
+  assert.match(els.sequential.title, /cycle/);
+});
+
+test('a page without the optional buttons simply has no such feature', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'clear']);
+  const { bar, selection } = build(els);
+  selection.claim.add('1'); selection.claim.add('2');
+  assert.doesNotThrow(() => bar.render());
+  assert.doesNotThrow(() => bar.wire());
+  assert.equal(els.claim.textContent, 'Bulk claim (2)');
+});
+
+test('Bulk claim and Bulk release go through the shared action and empty their selection', async () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.release.set('77', '9');
+  bar.wire();
+  await els.claim.listeners.click();
+  assert.deepEqual(calls.claimMany, [[1]]);
+  assert.equal(selection.claim.size, 0);
+  await els.release.listeners.click();
+  assert.deepEqual(calls.releaseMany, [[['77', '9']]]);
+  assert.equal(selection.release.size, 0);
+});
+
+test('Clear empties both selections and lets the page repaint its cards', () => {
+  const els = stubPage(['bar', 'count', 'claim', 'release', 'parallel', 'sequential', 'clear']);
+  const { bar, selection, calls } = build(els);
+  selection.claim.add('1'); selection.release.set('77', '9');
+  bar.clearSelection();
+  assert.equal(selection.claim.size + selection.release.size, 0);
+  assert.equal(calls.cleared, true);
+  assert.equal(els.bar.hidden, true);
+});
+
+// --- the two boards use it, and neither keeps a private copy -----------------
+
+test('both boards build the shared toolbar and carry all five buttons', () => {
+  const work = read('work.html');
+  const goals = read('goals.html');
+  for (const k of ['claim', 'release', 'parallel', 'sequential', 'clear']) {
+    assert.match(work, new RegExp(`id="bulk-${k}-btn"`), `work.html has bulk-${k}-btn`);
+    assert.match(goals, new RegExp(`id="goal-bulk-${k}-btn"`), `goals.html has goal-bulk-${k}-btn`);
+  }
+  assert.match(read('work.js'), /OTBBulkToolbar\.makeBulkToolbar\(/);
+  assert.match(read('goals-render.js'), /OTBBulkToolbar\.makeBulkToolbar\(/);
+  for (const [page, scripts] of [['work.html', ['bulk-toolbar.js', 'work.js']], ['goals.html', ['bulk-toolbar.js', 'goals-render.js']]]) {
+    const html = read(page);
+    const at = (n) => html.indexOf(`src="/builders/${n}`);
+    assert.ok(at(scripts[0]) > -1 && at(scripts[0]) < at(scripts[1]), `${page}: bulk-toolbar.js loads before ${scripts[1]}`);
+  }
+});
+
+test('no board keeps a private copy of the toolbar logic', () => {
+  for (const f of ['work.js', 'goals-page.js', 'goals-render.js']) {
+    const src = read(f);
+    assert.doesNotMatch(src, /function topoOrder|function buildBulk(Parallel|Sequential)Prompt|function scheduleValidate|function doBulk(Claim|Release)|function doGoalBulkClaim/, `${f} re-grew toolbar logic`);
+  }
+});
+
+test('the goal board offers a release checkbox on the viewer\'s own cards, and it styles', () => {
+  const render = read('goals-render.js');
+  assert.match(render, /class="wip__select" data-claim-id=/, 'a mine-active card carries the release checkbox');
+  assert.match(read('goals-page.js'), /closest\('\.task__select, \.wip__select'\)/, 'the card list listens for it');
+  assert.match(read('style.css'), /\n\.wip__select \{/, '.wip__select is in the shared sheet the goal board loads');
+});
+
+test('goals.html no longer borrows work.css, and work.css no longer holds what it lent', () => {
+  assert.doesNotMatch(read('goals.html'), /work\.css/, 'the goal board is off the board-only sheet');
+  const work = read('work.css');
+  for (const sel of ['.claim-count-line', '.wip__release', '.wip__select']) {
+    assert.ok(!new RegExp(`^${sel.replace('.', '\\.')}(\\s|:|,|\\{)`, 'm').test(work), `work.css must not restate ${sel}`);
+  }
+  const style = read('style.css');
+  for (const sel of ['.claim-count-line', '.wip__release', '.wip__select']) {
+    assert.ok(new RegExp(`^${sel.replace('.', '\\.')} \\{`, 'm').test(style), `style.css carries ${sel}`);
+  }
+});

package/tests/claim_action.mjs

@@ -264,8 +264,8 @@ await test('both boards CONSTRUCT the shared action, not just its error text', (
 
 await test('every claim/release entry point routes through it', () => {
   const sites = {
-    'work.js': ['doClaim', 'doRelease', 'doBulkClaim', 'doBulkRelease'],
-    'goals-page.js': ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim'],
+    'work.js': ['doClaim', 'doRelease'],
+    'goals-page.js': ['doGoalClaim', 'doGoalRelease'],
   };
   for (const [f, fns] of Object.entries(sites)) {
     const src = read('modules', 'hall-ui', 'public', f);
@@ -278,6 +278,15 @@ await test('every claim/release entry point routes through it', () => {
         `${f}: ${fn} still maps its own refusal`);
     }
   }
+  // Both boards' BULK claim/release live in the shared toolbar now (task 1003141),
+  // built over the same action — so the same rule is checked there, once.
+  const bulk = read('modules', 'hall-ui', 'public', 'bulk-toolbar.js');
+  for (const fn of ['doBulkClaim', 'doBulkRelease']) {
+    const m = bulk.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n    \\}`));
+    assert.ok(m, `bulk-toolbar.js: ${fn} not found`);
+    assert.match(m[0], /claimAction\.(claimMany|releaseMany)\(/, `bulk-toolbar.js: ${fn} does not go through the shared action`);
+    assert.doesNotMatch(m[0], /friendlyClaimError\(/, `bulk-toolbar.js: ${fn} maps its own refusal`);
+  }
 });
 
 await test('no call site reloads on top of the action\'s own refresh', async () => {
@@ -287,7 +296,7 @@ await test('no call site reloads on top of the action\'s own refresh', async ()
   // twice. work.js's doBulkClaim is the correct shape: redraw the toolbar,
   // never re-fetch. A finally that awaits a loader is the tell.
   const src = read('modules', 'hall-ui', 'public', 'goals-page.js');
-  for (const fn of ['doGoalClaim', 'doGoalRelease', 'doGoalBulkClaim']) {
+  for (const fn of ['doGoalClaim', 'doGoalRelease']) {
     const m = src.match(new RegExp(`async function ${fn}\\([^)]*\\) \\{[\\s\\S]*?\\n  \\}`));
     assert.ok(m, `${fn} not found`);
     assert.doesNotMatch(m[0], /finally \{[\s\S]*?await loadGoalTasks\(/,
@@ -393,7 +402,7 @@ await test('the cache-bust moved on every page whose script changed', () => {
   ]) {
     const html = read('modules', 'hall-ui', 'public', page);
     for (const s of scripts) {
-      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-26-claimaction1'), `${page}: ${s} not busted`);
+      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-30-bulktoolbar'), `${page}: ${s} not busted`);
     }
   }
 });

package/tests/founding_mode.mjs

@@ -0,0 +1,294 @@
+// tests/founding_mode.mjs — PROJECT FOUNDING MODE is a mode the existing hall wears,
+// never a second hall (task 1004422 / BV2.PS03, goal 1000121; the blend rule in
+// docs/design/project-startup-direction.md).
+//
+// The owner's no-hijack condition is the headline: a hall that is NOT founding must be
+// the hall it was. So the client half is RUN, not grepped. The real applyFounding is
+// sliced out of shell.js and driven over a small fake DOM, fed by the REAL server
+// shaper, so the path from the stored stage to the dimmed nav item is exercised
+// whole. Then OFF is proven to leave, and to restore, the DOM exactly.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8').replace(/\r\n/g, '\n');
+const fm = require(path.join(ROOT, 'modules', 'onboarding', 'founding-mode.js'));
+
+const SHELL = read('modules', 'hall-ui', 'public', 'shell.js');
+const HALL_RENDER = read('modules', 'hall-ui', 'public', 'hall-render.js');
+const ME = read('src', 'bongos', 'routes', 'me.js');
+const PORT = read('modules', 'onboarding', 'port.js');
+
+// ── the server shaper (pure) ────────────────────────────────────────────────
+
+test('not founding in any form is null (OFF)', () => {
+  assert.equal(fm.shapeFoundingMode(null), null);
+  assert.equal(fm.shapeFoundingMode({ active: null }), null);
+  assert.equal(fm.shapeFoundingMode({ active: 'false', stage: 'scope' }), null);
+  assert.equal(fm.shapeFoundingMode({ active: 'maybe', stage: 'scope' }), null);
+});
+
+test('an unknown stage fails CLOSED — OFF, never a hall stuck half-asleep', () => {
+  assert.equal(fm.shapeFoundingMode({ active: 'true', stage: 'launch' }), null);
+});
+
+test('active with no stage yet is the decide pre-stage, and every room sleeps', () => {
+  const f = fm.shapeFoundingMode({ active: 'true' });
+  assert.equal(f.stage, 'decide');
+  assert.equal(f.stage_number, 0);
+  assert.equal(f.stage_count, 5);
+  for (const id of ['roadmap', 'goals', 'goal-map', 'work', 'board-room', 'economy', 'ranks', 'collab', 'roster']) {
+    assert.ok(id in f.asleep, `${id} sleeps while deciding`);
+  }
+});
+
+test('a room wakes once the stage that wakes it is behind', () => {
+  const f = fm.shapeFoundingMode({ active: 'true', stage: 'charter' });
+  for (const id of ['roadmap', 'goals', 'goal-map', 'work']) assert.ok(!(id in f.asleep), `${id} woke`);
+  assert.equal(f.asleep['board-room'], 'charter');
+  assert.equal(f.asleep.economy, 'legalize');
+  assert.equal(f.asleep.ranks, 'legislation');
+  assert.equal(f.asleep.collab, 'alive', 'community wakes only when the planet is alive');
+});
+
+test('the day counts from the founding day; an unreadable timestamp drops it', () => {
+  const now = new Date('2026-10-09T12:00:00Z');
+  assert.equal(fm.dayOf('2026-10-01T09:00:00Z', now), 9);
+  assert.equal(fm.dayOf('not a date', now), null);
+  assert.equal(fm.dayOf(null, now), null);
+});
+
+test('foundingModeFor fails closed when the settings read throws', async () => {
+  const got = await fm.foundingModeFor({ getSetting: async () => { throw new Error('db down'); } });
+  assert.equal(got, null);
+});
+
+test('setFoundingMode refuses an unknown stage and stamps started_at once', async () => {
+  const store = new Map();
+  const deps = {
+    getSetting: async (k) => (store.has(k) ? { key: k, value: store.get(k) } : null),
+    setSetting: async (k, v) => { store.set(k, String(v)); return { key: k, value: String(v) }; },
+    now: new Date('2026-10-01T00:00:00Z'),
+  };
+  await assert.rejects(fm.setFoundingMode({ stage: 'launch' }, 1, deps), /unknown founding stage/);
+  const first = await fm.setFoundingMode({ active: true, stage: 'decide' }, 1, deps);
+  assert.equal(first.stage, 'decide');
+  const stamp = store.get(fm.KEYS.STARTED_AT);
+  deps.now = new Date('2026-10-05T00:00:00Z');
+  await fm.setFoundingMode({ active: true, stage: 'scope' }, 1, deps);
+  assert.equal(store.get(fm.KEYS.STARTED_AT), stamp, 'started_at is not re-stamped');
+  assert.equal(await fm.setFoundingMode({ active: false }, 1, deps), null, 'switching off reads back as OFF');
+});
+
+test('every room the server can put to sleep is a real NAV item', () => {
+  // The map is keyed by NAV id so the client never re-derives it; a renamed NAV id
+  // would silently leave a room awake. Hold the two together.
+  const nav = SHELL.slice(SHELL.indexOf('var NAV = ['), SHELL.indexOf('var NAV_COLLAPSE_KEY'));
+  const ids = new Set([...nav.matchAll(/id: '([a-z-]+)'/g)].map((m) => m[1]));
+  const all = [...Object.values(fm.WAKES).flat(), ...fm.WAKES_WHEN_ALIVE];
+  for (const id of all) assert.ok(ids.has(id), `NAV has no item '${id}'`);
+});
+
+// ── the client, RUN over a fake DOM ─────────────────────────────────────────
+
+class El {
+  constructor(tag) {
+    this.tag = tag; this.id = ''; this.className = ''; this.dataset = {}; this.attrs = {};
+    this.children = []; this.parent = null; this.textContent = ''; this.innerHTML = '';
+    const self = this;
+    this.classList = {
+      add(c) { const s = new Set(self.className.split(' ').filter(Boolean)); s.add(c); self.className = [...s].join(' '); },
+      remove(c) { self.className = self.className.split(' ').filter((x) => x && x !== c).join(' '); },
+      contains(c) { return self.className.split(' ').includes(c); },
+    };
+  }
+  appendChild(c) { c.parent = this; this.children.push(c); return c; }
+  insertBefore(c, ref) { c.parent = this; const i = this.children.indexOf(ref); this.children.splice(i < 0 ? 0 : i, 0, c); return c; }
+  get parentNode() { return this.parent; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); c.parent = null; return c; }
+  setAttribute(k, v) { this.attrs[k] = v; }
+  querySelector(sel) { return sel === '[data-wakes-tag]' ? (this.children.find((c) => 'data-wakes-tag' in c.attrs) || null) : null; }
+  get firstChild() { return this.children[0] || null; }
+}
+
+function makeHall() {
+  const navIds = ['home', 'roadmap', 'goals', 'goal-map', 'work', 'board-room', 'economy', 'ranks', 'collab', 'roster', 'profile'];
+  const nav = navIds.map((id) => { const a = new El('a'); a.id = 'nav-' + id; a.className = 'nav-item'; return a; });
+  const appBody = new El('div');
+  const topbar = new El('header'); topbar.id = 'app-topbar';
+  appBody.appendChild(topbar);
+  const root = { dataset: {} };
+  const document = {
+    documentElement: root,
+    createElement: (t) => new El(t),
+    querySelector: (sel) => (sel === '.app-body' ? appBody : null),
+    querySelectorAll: (sel) => (sel === '#app-sidebar .nav-item--asleep' ? nav.filter((a) => a.classList.contains('nav-item--asleep')) : []),
+    getElementById: (id) => nav.find((a) => a.id === id) || appBody.children.find((c) => c.id === id) || null,
+  };
+  return { document, nav, appBody, root };
+}
+
+// The REAL escaper and the real wake map are sliced out of shell.js with the function,
+// so the band's escaping is the shell's own, not a stand-in that agrees with the test.
+function sliceFn(name) {
+  const start = SHELL.indexOf('  function ' + name + '(');
+  const end = SHELL.indexOf('\n  }\n', start);
+  assert.ok(start > -1 && end > start, name + ' was located in shell.js');
+  return SHELL.slice(start, end + 4);
+}
+function loadApplyFounding(document, access, brand = { identity: { productName: 'Kestrel' } }) {
+  const wakeStart = SHELL.indexOf('  var WAKE_TEXT = {');
+  const wakeEnd = SHELL.indexOf('};', wakeStart) + 2;
+  assert.ok(wakeStart > -1, 'WAKE_TEXT was located in shell.js');
+  const src = [SHELL.slice(wakeStart, wakeEnd), sliceFn('esc'), sliceFn('applyFounding')].join('\n');
+  return new Function('document', 'brand', 'access', `${src}\nreturn applyFounding;`)(document, brand, access);
+}
+
+const snapshot = (h) => JSON.stringify({
+  root: h.root.dataset,
+  body: h.appBody.children.map((c) => c.id),
+  nav: h.nav.map((a) => ({ id: a.id, cls: a.className, data: a.dataset, kids: a.children.length })),
+});
+
+test('THE NO-HIJACK CONDITION: a hall that is not founding is untouched', () => {
+  const h = makeHall();
+  const before = snapshot(h);
+  const access = { founding: null };
+  loadApplyFounding(h.document, access)();
+  assert.equal(snapshot(h), before, 'null founding changes nothing at all');
+});
+
+test('not founding touches NO node — the document is never even queried', () => {
+  // Stronger than "ends up the same": a page that never wore the mode is not read.
+  const h = makeHall();
+  const touched = [];
+  const spy = new Proxy(h.document, {
+    get(t, k) { if (k !== 'documentElement') touched.push(String(k)); return t[k]; },
+  });
+  loadApplyFounding(spy, { founding: null })();
+  loadApplyFounding(spy, { founding: { active: false } })();
+  assert.deepEqual(touched, [], 'no DOM method was called');
+});
+
+test('founding ON: the band above the topbar, and the rooms the server named asleep', () => {
+  const h = makeHall();
+  const now = new Date('2026-10-09T12:00:00Z');
+  const access = { founding: fm.shapeFoundingMode({ active: 'true', stage: 'strategize', startedAt: '2026-10-01T09:00:00Z' }, now) };
+  loadApplyFounding(h.document, access)();
+  assert.equal(h.root.dataset.founding, 'on');
+  const band = h.appBody.children[0];
+  assert.equal(band.id, 'founding-band', 'the band is the first child of .app-body, above the topbar');
+  assert.equal(h.appBody.children[1].id, 'app-topbar', 'the topbar itself is kept, not replaced');
+  assert.match(band.innerHTML, /Project founding mode/);
+  assert.match(band.innerHTML, /Kestrel is still being founded/);
+  assert.match(band.innerHTML, /stage 2 of 5 · strategize · day 9/);
+  const byId = (id) => h.nav.find((a) => a.id === 'nav-' + id);
+  assert.ok(!byId('goals').classList.contains('nav-item--asleep'), 'scope is behind: goals is awake');
+  assert.ok(byId('work').classList.contains('nav-item--asleep'), 'strategize is current: tasks still sleeps');
+  assert.equal(byId('work').children[0].textContent, 'opens after strategy', 'a sentence, never a raw slug');
+  assert.equal(byId('collab').children[0].textContent, 'opens when alive');
+  assert.ok(!byId('home').classList.contains('nav-item--asleep'), 'home is never put to sleep');
+});
+
+test('founding OFF after ON restores the hall exactly — OFF removes, it does not hide', () => {
+  const h = makeHall();
+  const before = snapshot(h);
+  const access = { founding: fm.shapeFoundingMode({ active: 'true', stage: 'decide' }) };
+  const apply = loadApplyFounding(h.document, access);
+  apply();
+  assert.notEqual(snapshot(h), before);
+  access.founding = null;
+  apply();
+  assert.equal(snapshot(h), before, 'band, asleep classes, wake tags and the root attribute are all gone');
+});
+
+test('the band escapes what it prints — a project name cannot inject markup', () => {
+  const h = makeHall();
+  const access = { founding: Object.assign(fm.shapeFoundingMode({ active: 'true', stage: 'scope' }), { waiting_on: ['<img src=x onerror=1>'] }) };
+  loadApplyFounding(h.document, access, { identity: { productName: '<script>alert(1)</script>' } })();
+  const html = h.appBody.children[0].innerHTML;
+  assert.ok(!html.includes('<script>'), 'the name is escaped');
+  assert.ok(!html.includes('<img'), 'the waiting-on names are escaped');
+  assert.match(html, /&lt;script&gt;/);
+});
+
+test('who the stage close is waiting on shows in the band when the server sends it', async () => {
+  const f = await fm.foundingModeFor({
+    getSetting: async (k) => ({ [fm.KEYS.ACTIVE]: { value: 'true' }, [fm.KEYS.STAGE]: { value: 'charter' } }[k] || null),
+    waitingOnFor: async (stage) => (stage === 'charter' ? ['Avery', 'Jordan'] : []),
+  });
+  assert.deepEqual(f.waiting_on, ['Avery', 'Jordan']);
+  const h = makeHall();
+  loadApplyFounding(h.document, { founding: f })();
+  assert.match(h.appBody.children[0].innerHTML, /waiting on Avery, Jordan/);
+});
+
+test('waiting-on reads the government port\'s genesis-stage status, sitting stages only', async () => {
+  const gov = {
+    genesisStageStatus: async () => ({ stages: [
+      { key: 'scope', state: 'passed', waiting_on: [] },
+      { key: 'charter', state: 'sitting', waiting_on: [{ display_name: 'Avery' }, { github_login: 'jordan' }] },
+      { key: 'legalize', state: 'not_put', waiting_on: [] },
+    ] }),
+  };
+  const read = (stage) => fm.foundingModeFor({
+    getSetting: async (k) => ({ [fm.KEYS.ACTIVE]: { value: 'true' }, [fm.KEYS.STAGE]: { value: stage } }[k] || null),
+    government: gov,
+  });
+  assert.deepEqual((await read('charter')).waiting_on, ['Avery', 'jordan']);
+  assert.equal((await read('scope')).waiting_on, null, 'a passed stage waits on nobody');
+  assert.equal(fm.waitingOnFromGovernment({}), null, 'a port without the read offers none');
+  assert.equal((await fm.foundingModeFor({
+    getSetting: async (k) => ({ [fm.KEYS.ACTIVE]: { value: 'true' } }[k] || null), government: null,
+  })).waiting_on, null, 'no government module: the mode still reads, without names');
+});
+
+test('a failing waiting-on source never turns the mode off', async () => {
+  const f = await fm.foundingModeFor({
+    getSetting: async (k) => ({ [fm.KEYS.ACTIVE]: { value: 'true' }, [fm.KEYS.STAGE]: { value: 'scope' } }[k] || null),
+    waitingOnFor: async () => { throw new Error('government down'); },
+  });
+  assert.equal(f.active, true);
+  assert.equal(f.waiting_on, null);
+});
+
+test('re-applying ON does not stack a second band or duplicate wake tags', () => {
+  const h = makeHall();
+  const access = { founding: fm.shapeFoundingMode({ active: 'true', stage: 'decide' }) };
+  const apply = loadApplyFounding(h.document, access);
+  apply(); apply();
+  assert.equal(h.appBody.children.filter((c) => c.id === 'founding-band').length, 1);
+  assert.equal(h.nav.find((a) => a.id === 'nav-work').children.length, 1);
+});
+
+// ── the wiring ──────────────────────────────────────────────────────────────
+
+test('only an explicit active:true turns the mode on', () => {
+  const fn = SHELL.slice(SHELL.indexOf('  function applyFounding()'));
+  assert.match(fn.slice(0, 400), /f && f\.active === true/);
+});
+
+test('/me carries founding_mode from the onboarding port, fail-open to null', () => {
+  assert.match(ME, /founding_mode: foundingMode/);
+  assert.match(ME, /onboarding\.foundingModeFor\(\)/);
+  const at = ME.indexOf('onboarding.foundingModeFor()');
+  assert.match(ME.slice(at, at + 200), /catch \(_\) \{ return null; \}/);
+  assert.match(PORT, /foundingModeFor: \(\.\.\.a\) => foundingMode\.foundingModeFor\(\.\.\.a\)/);
+});
+
+test('BOTH applyAccess callers pass it, or the index would never show the band', () => {
+  assert.match(SHELL, /founding: me\.founding_mode \|\| null/);
+  assert.match(HALL_RENDER, /founding: \(ctx\.lastMeState && ctx\.lastMeState\.founding_mode\) \|\| null/);
+});
+
+test('founding mode adds no page, no route and no nav item — it is a mode', () => {
+  const nav = SHELL.slice(SHELL.indexOf('var NAV = ['), SHELL.indexOf('var NAV_COLLAPSE_KEY'));
+  assert.ok(!/founding|genesis/i.test(nav), 'the NAV model must not grow a founding entry');
+  const hall = fs.readdirSync(path.join(ROOT, 'modules', 'hall-ui', 'public'));
+  assert.ok(!hall.some((f) => /^founding\./.test(f)), 'no founding page file');
+});