@bongos/core 1.20.47 → 1.20.49

package/tests/goal_criterion_confirm_ui.mjs

@@ -1,4 +1,6 @@
-// tests/goal_criterion_confirm_ui.mjs — in-hall criterion confirmation (task 1002164).
+// tests/goal_criterion_confirm_ui.mjs — in-hall criterion confirmation (task 1002164),
+// now the in-hall UAT (task 1004402, ADR 0351): the bare Confirm button (a POST
+// /satisfy) is gone, and a criterion awaiting UAT is tested and signed off here.
 //
 // The goal's bx-hall criterion says core task actions must work in the builders
 // hall WITHOUT invoking the LLM. Criterion confirmation violated that: the goal
@@ -47,20 +49,39 @@ const GOALS_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/go
 const GOAL_FOREST_RENDER_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goal-forest-render.js'), 'utf8');
 const GOALS_RENDER_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-render.js'), 'utf8');
 
+const UAT_UI_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/criterion-uat-ui.js'), 'utf8');
+
 const { test, summary } = makeRunner();
 
+// task 1004402: the server sends each criterion's UAT state (ADR 0351). The
+// "legacy" set is a server too old to send it.
 const CRIT = {
-  satisfied: { id: 501, criterion_id: 'c-done', criterion_md: 'Already confirmed', satisfied: true, pending_review: false },
-  pending: { id: 502, criterion_id: 'c-pending', criterion_md: 'All its tasks shipped', satisfied: false, pending_review: true },
-  open: { id: 503, criterion_id: 'c-open', criterion_md: 'Still has open work', satisfied: false, pending_review: false },
+  satisfied: { id: 501, criterion_id: 'c-done', criterion_md: 'Already confirmed', satisfied: true, pending_review: false, uat_state: 'satisfied_uat' },
+  pending: { id: 502, criterion_id: 'c-pending', criterion_md: 'All its tasks shipped', satisfied: false, pending_review: true, uat_state: 'awaiting_uat', awaiting_uat: true },
+  open: { id: 503, criterion_id: 'c-open', criterion_md: 'Still has open work', satisfied: false, pending_review: false, uat_state: 'open' },
 };
+const LEGACY = Object.values(CRIT).map(({ uat_state, awaiting_uat, ...c }) => c);
+
+// A fake element the UAT wiring can query: data-* lookups answer from `parts`.
+function fakeNode(parts = {}) {
+  return {
+    dataset: {}, hidden: false, textContent: '', disabled: false, isConnected: true, children: [],
+    querySelector: (sel) => {
+      for (const [k, v] of Object.entries(parts)) if (sel.includes(k)) return v;
+      return null;
+    },
+    appendChild(child) { this.children.push(child); return child; },
+    setAttribute() {},
+    closest() { return null; },
+  };
+}
 
 // Boot goals-page.js against a fake API and return what it rendered + recorded.
 // `rank` drives the client-side control gate; `goalStatus` drives the goal state.
-async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), satisfyResponse, criterionlessTaskCount } = {}) {
-  const calls = { requests: [], toasts: [] };
+async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), criterionlessTaskCount, uatPost, uatView, upload } = {}) {
+  const calls = { requests: [], toasts: [], fetches: [] };
   const els = new Map();
-  const listeners = new Map(); // selector -> [handler]
+  const listeners = new Map(); // selector -> { click: [], submit: [] }
 
   const makeEl = (key) => {
     const el = {
@@ -68,11 +89,10 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
       innerHTML: '',
       classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
       setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
-      appendChild() {}, focus() {}, click() {}, querySelectorAll() { return []; },
+      appendChild() {}, focus() {}, click() {}, querySelectorAll() { return []; }, querySelector() { return null; },
       addEventListener(type, fn) {
-        if (type !== 'click') return;
-        if (!listeners.has(key)) listeners.set(key, []);
-        listeners.get(key).push(fn);
+        if (!listeners.has(key)) listeners.set(key, { click: [], submit: [] });
+        if (listeners.get(key)[type]) listeners.get(key)[type].push(fn);
       },
     };
     return el;
@@ -87,18 +107,17 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const detail = { goal, members: [], criteria, dependencies: [], criterionless_task_count: criterionlessTaskCount };
 
   const api = {
-    request(method, p) {
-      calls.requests.push([method, p]);
-      const reply = (data, status = 200) => Promise.resolve({ status, ok: true, data });
+    request(method, p, opts) {
+      calls.requests.push([method, p, opts && opts.body]);
+      const reply = (data, status = 200) => Promise.resolve({ status, ok: status < 400, data });
       if (method === 'GET' && /\/me$/.test(p)) return reply({ builder: { id: 1, rank }, active_claims: [] });
       if (method === 'GET' && /\/goals$/.test(p)) return reply({ goals: [goal] });
       if (method === 'GET' && /\/goals\/7$/.test(p)) return reply(detail);
       if (method === 'GET' && /\/tasks\?/.test(p)) return reply({ tasks: [] });
       if (method === 'GET' && /\/conflicts$/.test(p)) return reply({ pairs: [] });
       if (method === 'GET' && /\/requests$/.test(p)) return reply({ requests: [] });
-      if (method === 'POST' && /\/done-when\/\d+\/satisfy$/.test(p)) {
-        return Promise.resolve(satisfyResponse || { status: 200, ok: true, data: { criterion: {}, goal_achieved: false, goal: null } });
-      }
+      if (method === 'GET' && /\/done-when\/\d+\/uat$/.test(p)) return Promise.resolve(uatView || reply({ criterion: { id: 502 }, uat_state: 'awaiting_uat', backend_only: false, checks: { code: true, live: { available: false }, uat: null } }));
+      if (method === 'POST' && /\/done-when\/\d+\/uat$/.test(p)) return Promise.resolve(uatPost || { status: 201, ok: true, data: { ok: true, criterion_closed: true, achieved_goals: [] } });
       return reply({});
     },
   };
@@ -146,11 +165,17 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
     getElementById: (id) => $(`#${id}`),
     querySelector: (sel) => $(sel),
     querySelectorAll: () => [],
-    createElement: () => makeEl('created'),
+    createElement: () => ({ ...makeEl('created'), remove() {} }),
     addEventListener() {},
   };
+  // The recording upload is a raw fetch (the API client only speaks JSON).
+  const fetchStub = async (url, init) => {
+    calls.fetches.push([url, init]);
+    const out = upload || { status: 201, body: { ok: true, recording: 'uat-502-0123456789abcdef.webm' } };
+    return { ok: out.status < 400, status: out.status, json: async () => out.body };
+  };
 
-  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
+  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise, fetch: fetchStub, CSS: { escape: (s) => String(s) } };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   // task 1003458: the page loads claim-action.js before this script; the stub
@@ -161,37 +186,62 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/bulk-toolbar.js'), 'utf8'), sandbox, { filename: 'bulk-toolbar.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });
+  // task 1004402: criterion-uat-ui.js loads before goals-render.js (goals.html).
+  vm.runInContext(UAT_UI_SRC, sandbox, { filename: 'criterion-uat-ui.js' });
   vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).
-  for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0));
-
-  const clickConfirm = async (critId) => {
-    const handlers = listeners.get('#goal-completion-body') || [];
-    assert.ok(handlers.length > 0, 'a click listener must be wired on the completion band');
-    const btn = { disabled: false, textContent: 'Confirm', dataset: { confirmCrit: String(critId) } };
-    const ev = {
-      target: { closest: (sel) => (sel === '[data-confirm-crit]' ? btn : null) },
-      preventDefault() {},
-    };
-    for (const fn of handlers) fn(ev);
-    for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0));
-    return btn;
+  const settle = async () => { for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0)); };
+  await settle();
+
+  const band = () => listeners.get('#goal-completion-body') || { click: [], submit: [] };
+
+  // Click "Test and sign off" on a criterion: the panel is appended to its row.
+  const openPanel = async (critId) => {
+    const row = fakeNode({});
+    const btn = { dataset: { uatOpen: String(critId) }, setAttribute() {}, closest: (sel) => (sel === '.crit' ? row : null) };
+    assert.ok(band().click.length > 0, 'a click listener must be wired on the completion band');
+    for (const fn of band().click) fn({ target: { closest: (sel) => (sel === '[data-uat-open]' ? btn : null) }, preventDefault() {} });
+    await settle();
+    return row;
+  };
+
+  // Submit a sign-off form: `file` given (even null = none chosen) = a UAT form
+  // with its file input; omitted = a backend sign-off form, which has none.
+  const submitForm = async ({ critId = 502, file, note = '', attest = null }) => {
+    const error = { hidden: true, textContent: '' };
+    const submitBtn = { disabled: false, textContent: 'Sign off', isConnected: true };
+    const parts = { 'button[type="submit"]': submitBtn, '[data-uat-note]': { value: note } };
+    if (file !== undefined) parts['[data-uat-file]'] = { files: file ? [file] : [] };
+    if (attest !== null) parts['[data-uat-attest]'] = { checked: attest };
+    const form = { ...fakeNode(parts), dataset: { uatForm: String(critId) } };
+    documentObj.querySelector = (sel) => (sel.includes('data-uat-error') ? error : $(sel));
+    const root = els.get('#goal-completion-body');
+    root.querySelector = (sel) => (sel.includes('data-uat-error') ? error : null);
+    for (const fn of band().submit) fn({ target: { closest: (sel) => (sel === '[data-uat-form]' ? form : null) }, preventDefault() {} });
+    await settle();
+    return { error, submitBtn };
   };
 
-  return { calls, band: $('#goal-completion-body').innerHTML, full: $('#goal-completion-full').innerHTML, clickConfirm };
+  return {
+    calls,
+    band: $('#goal-completion-body').innerHTML,
+    full: $('#goal-completion-full').innerHTML,
+    openPanel, submitForm,
+  };
 }
 
+const posts = (calls, re) => calls.requests.filter(([m, p]) => m === 'POST' && re.test(p));
+
 // =========================================================================
-// The three criterion states
+// The criterion states
 // =========================================================================
 
-await test('the goal detail renders all three criterion states distinguishably', async () => {
+await test('the goal detail renders the criterion states distinguishably', async () => {
   const { band } = await render();
-  assert.match(band, /crit--done/, 'a confirmed criterion keeps its done styling');
-  assert.match(band, /crit--pending/, 'a met-but-unconfirmed criterion gets its own state');
-  // The open criterion is the one with neither modifier.
+  assert.match(band, /crit--done/, 'a closed criterion keeps its done styling');
+  assert.match(band, /crit--pending/, 'an awaiting-UAT criterion gets its own state');
   const items = band.match(/<li class="crit[^"]*"/g) || [];
   assert.equal(items.length, 3, `three criteria render — got ${JSON.stringify(items)}`);
   assert.equal(items.filter((s) => /crit--done/.test(s)).length, 1, 'exactly one done');
@@ -199,58 +249,82 @@ await test('the goal detail renders all three criterion states distinguishably',
   assert.equal(items.filter((s) => !/crit--(done|pending)/.test(s)).length, 1, 'exactly one plain/open');
 });
 
-await test('a pending criterion is the ONLY one offering Confirm (Metic)', async () => {
+await test('each state reads in the server\'s own words (Awaiting UAT, Satisfied (UAT))', async () => {
+  const { band } = await render();
+  assert.match(band, /class="crit-state crit-state--awaiting_uat">Awaiting UAT</);
+  assert.match(band, /class="crit-state crit-state--satisfied_uat">Satisfied \(UAT\)</);
+  assert.doesNotMatch(band, /crit-state--open/, 'an open criterion carries no pill: the empty mark already says so');
+});
+
+await test('a Backend-only criterion carries a visible tag', async () => {
+  const { band } = await render({ criteria: [{ ...CRIT.pending, backend_only: true }] });
+  assert.match(band, /class="crit-tag"[^>]*>Backend-only</);
+});
+
+await test('an Awaiting UAT criterion is the ONLY one offering "Test and sign off" (Metic)', async () => {
   const { band } = await render({ rank: 'metic' });
-  const buttons = band.match(/data-confirm-crit="(\d+)"/g) || [];
-  assert.equal(buttons.length, 1, `exactly one Confirm control — got ${JSON.stringify(buttons)}`);
-  assert.match(buttons[0], new RegExp(`"${CRIT.pending.id}"`), 'it targets the pending criterion');
+  const buttons = band.match(/data-uat-open="(\d+)"[^>]*>Test and sign off/g) || [];
+  assert.equal(buttons.length, 1, `exactly one sign-off control — got ${JSON.stringify(buttons)}`);
+  assert.match(buttons[0], new RegExp(`"${CRIT.pending.id}"`), 'it targets the awaiting criterion');
+  assert.match(band, /data-uat-open="501"[^>]*>See the UAT/, 'a UAT-closed criterion offers its evidence instead');
 });
 
-await test('an Archon also gets Confirm (Metic+ means at-or-above, not equals)', async () => {
+await test('an Archon also gets the control (Metic+ means at-or-above, not equals)', async () => {
   const { band } = await render({ rank: 'archon' });
-  assert.match(band, /data-confirm-crit/, 'an Archon outranks Metic and keeps the control');
+  assert.match(band, />Test and sign off</);
 });
 
-await test('a Xenos sees the pending STATE but never the Confirm control', async () => {
+await test('a Xenos sees the Awaiting UAT state but never the sign-off control', async () => {
   const { band } = await render({ rank: 'xenos' });
   assert.match(band, /crit--pending/, 'the state is still visible to everyone');
-  assert.doesNotMatch(band, /data-confirm-crit/, 'the action is hidden below Metic');
-  assert.match(band, /crit__flag/, 'a read-only "Ready" flag stands in for the button');
+  assert.doesNotMatch(band, />Test and sign off</, 'the action is hidden below Metic');
+  assert.match(band, /class="crit__flag"[^>]*>Awaiting UAT</, 'a read-only flag stands in for the button');
 });
 
-await test('a thetes (below Metic) also gets no Confirm control', async () => {
+await test('a thetes (below Metic) also gets no sign-off control', async () => {
   const { band } = await render({ rank: 'thetes' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'thetes is below metic in the ladder');
+  assert.doesNotMatch(band, />Test and sign off</);
 });
 
-await test('an achieved goal offers no Confirm (nothing left to confirm)', async () => {
-  const { band } = await render({ goalStatus: 'achieved' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'a closed goal is not actionable');
+await test('an achieved or archived goal offers no sign-off', async () => {
+  for (const goalStatus of ['achieved', 'archived']) {
+    const { band } = await render({ goalStatus });
+    assert.doesNotMatch(band, />Test and sign off</, goalStatus);
+  }
 });
 
-await test('an archived goal offers no Confirm', async () => {
-  const { band } = await render({ goalStatus: 'archived' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'an archived goal is not actionable');
+await test('THE BYPASS IS GONE: nothing on the page can POST /satisfy', async () => {
+  for (const criteria of [Object.values(CRIT), LEGACY]) {
+    const { band, full } = await render({ rank: 'archon', criteria });
+    assert.doesNotMatch(band + full, /data-confirm-crit|\/satisfy/, 'no bare Confirm survives, on a new or an old server');
+  }
+  assert.doesNotMatch(SRC, /\/satisfy`/, 'goals-page.js holds no /satisfy call at all');
 });
 
 // =========================================================================
-// The summary line — the /goal-review punt is gone
+// The summary line
 // =========================================================================
 
 await test('the summary no longer sends the builder to the /goal-review CLI skill', async () => {
   const { band } = await render();
-  assert.doesNotMatch(band, /goal-review/, 'the LLM/CLI punt is removed — this is the whole point of the task');
+  assert.doesNotMatch(band, /goal-review/);
 });
 
-await test('the summary counts what is actually ready to confirm', async () => {
+await test('the summary counts what is awaiting UAT', async () => {
   const { band } = await render();
-  assert.match(band, /1 criterion is met and ready to confirm/, 'singular phrasing for one pending criterion');
+  assert.match(band, /1 criterion is awaiting UAT: the work has shipped/, 'singular phrasing for one awaiting criterion');
 });
 
-await test('with nothing pending, the summary explains when a criterion becomes confirmable', async () => {
+await test('with nothing awaiting, the summary explains when a criterion is ready for its UAT', async () => {
   const { band } = await render({ criteria: [CRIT.satisfied, CRIT.open] });
-  assert.doesNotMatch(band, /ready to confirm/, 'no false "ready" claim when nothing is pending');
-  assert.match(band, /once every task linked to it has shipped/, 'explains the precondition instead');
+  assert.doesNotMatch(band, /awaiting UAT:/);
+  assert.match(band, /ready for its UAT once every task linked to it has shipped/);
+});
+
+await test('an older server (no uat_state) keeps the old sentence and draws no UAT control', async () => {
+  const { band } = await render({ criteria: LEGACY });
+  assert.match(band, /1 criterion is met and ready to confirm/);
+  assert.doesNotMatch(band, /data-uat-open|crit-state/, 'no UAT vocabulary the server did not send');
 });
 
 // =========================================================================
@@ -289,47 +363,70 @@ await test('an achieved goal keeps its own summary line', async () => {
 });
 
 // =========================================================================
-// The action itself
+// The action itself — the real wiring, driven by events
 // =========================================================================
 
-await test('clicking Confirm POSTs /done-when/:id/satisfy for that criterion', async () => {
-  const { calls, clickConfirm } = await render();
-  await clickConfirm(CRIT.pending.id);
-  const posts = calls.requests.filter(([m, p]) => m === 'POST' && /\/done-when\/\d+\/satisfy$/.test(p));
-  assert.equal(posts.length, 1, `exactly one satisfy POST — got ${JSON.stringify(calls.requests)}`);
-  assert.match(posts[0][1], new RegExp(`/done-when/${CRIT.pending.id}/satisfy$`), 'targets the clicked criterion');
+await test('opening a criterion reads GET /done-when/:id/uat and draws the panel under its row', async () => {
+  const { calls, openPanel } = await render();
+  const row = await openPanel(CRIT.pending.id);
+  assert.ok(calls.requests.some(([m, p]) => m === 'GET' && /\/done-when\/502\/uat$/.test(p)), 'the UAT view is read');
+  assert.equal(row.children.length, 1, 'one panel appended to the row');
+  assert.match(row.children[0].innerHTML, /data-uat-form="502"/, 'with the sign-off form');
+  assert.match(row.children[0].innerHTML, /I tried this on the live site/, 'and the attestation, since this site cannot read its deploy');
 });
 
-await test('confirming re-reads the goal so the row updates in place (no manual refresh)', async () => {
-  const { calls, clickConfirm } = await render();
+await test('a UAT uploads the recording as raw bytes, THEN signs off naming it, then re-reads the goal', async () => {
+  const { calls, submitForm } = await render();
   const before = calls.requests.filter(([m, p]) => m === 'GET' && /\/goals\/7$/.test(p)).length;
-  await clickConfirm(CRIT.pending.id);
+  const file = { type: 'video/webm', size: 1024 };
+  await submitForm({ file, note: 'made a rank, assigned it', attest: true });
+  assert.equal(calls.fetches.length, 1, 'one upload');
+  assert.match(calls.fetches[0][0], /\/done-when\/502\/uat\/recording$/);
+  assert.equal(calls.fetches[0][1].body, file, 'the file itself is the body, not base64');
+  assert.equal(calls.fetches[0][1].headers['Content-Type'], 'video/webm');
+  const signed = posts(calls, /\/done-when\/502\/uat$/);
+  assert.equal(signed.length, 1);
+  // Compared through JSON: an object born in the vm is never strictly deepEqual.
+  assert.equal(JSON.stringify(signed[0][2]), JSON.stringify({ kind: 'uat', recording: 'uat-502-0123456789abcdef.webm', note: 'made a rank, assigned it', live_attested: true }));
   const after = calls.requests.filter(([m, p]) => m === 'GET' && /\/goals\/7$/.test(p)).length;
-  assert.ok(after > before, 'the detail is force-reloaded after a successful confirm');
+  assert.ok(after > before, 'the detail is force-reloaded so the row closes in place');
+  assert.ok(calls.toasts.some((t) => /criterion is closed/.test(t)));
 });
 
-await test('confirming the LAST criterion announces the goal auto-achieved', async () => {
-  const { calls, clickConfirm } = await render({
-    satisfyResponse: { status: 200, ok: true, data: { criterion: {}, goal_achieved: true, goal: { id: 7, status: 'achieved' } } },
-  });
-  await clickConfirm(CRIT.pending.id);
-  assert.ok(calls.toasts.some((t) => /achieved/i.test(t)), `the auto-achieve is surfaced — got ${JSON.stringify(calls.toasts)}`);
+await test('a backend sign-off sends no recording and requires saying how it was checked', async () => {
+  const empty = await render();
+  const { error } = await empty.submitForm({ note: '   ' });
+  assert.equal(error.textContent, 'Say how you checked it.');
+  assert.equal(posts(empty.calls, /\/uat$/).length, 0, 'nothing is sent without it');
+  const ok = await render();
+  await ok.submitForm({ note: 'the audit log has the row' });
+  assert.equal(JSON.stringify(posts(ok.calls, /\/done-when\/502\/uat$/)[0][2]), JSON.stringify({ kind: 'backend_signoff', note: 'the audit log has the row' }));
+  assert.equal(ok.calls.fetches.length, 0, 'no upload for a backend sign-off');
 });
 
-await test('an ordinary confirm reports success without claiming the goal is achieved', async () => {
-  const { calls, clickConfirm } = await render();
-  await clickConfirm(CRIT.pending.id);
-  assert.ok(calls.toasts.some((t) => /Criterion confirmed\.$/.test(t)), `plain confirmation — got ${JSON.stringify(calls.toasts)}`);
-  assert.ok(!calls.toasts.some((t) => /achieved/i.test(t)), 'no false auto-achieve claim');
+await test('the page refuses before sending: no file, wrong type, over 100 MB, attestation unticked', async () => {
+  const cases = [
+    [{ file: null, attest: true }, 'Choose the recording first.'],
+    [{ file: { type: 'image/png', size: 10 }, attest: true }, 'A UAT recording must be an mp4 or webm video.'],
+    [{ file: { type: 'video/mp4', size: 100 * 1024 * 1024 + 1 }, attest: true }, /over the 100 MB cap/],
+    [{ file: { type: 'video/mp4', size: 10 }, attest: false }, 'Confirm that you tried it on the live site.'],
+  ];
+  for (const [input, expected] of cases) {
+    const r = await render();
+    const { error } = await r.submitForm(input);
+    if (expected instanceof RegExp) assert.match(error.textContent, expected); else assert.equal(error.textContent, expected);
+    assert.equal(r.calls.fetches.length, 0, 'nothing was uploaded');
+    assert.equal(posts(r.calls, /\/uat$/).length, 0, 'nothing was signed');
+  }
 });
 
-await test('a double-click fires the satisfy POST only once', async () => {
-  const { calls, clickConfirm } = await render();
-  const handlersFired = clickConfirm(CRIT.pending.id);
-  await clickConfirm(CRIT.pending.id);
-  await handlersFired;
-  const posts = calls.requests.filter(([m, p]) => m === 'POST' && /\/satisfy$/.test(p));
-  assert.equal(posts.length, 1, `in-flight guard holds — got ${posts.length} POSTs`);
+await test('a server refusal is shown in the server\'s own words, and the goal achieved on the last one is announced', async () => {
+  const refused = await render({ uatPost: { status: 403, ok: false, data: { error: { code: 'signer_shipped_this_work', message: 'You shipped work linked to this criterion, so someone else has to sign it off.' } } } });
+  const { error } = await refused.submitForm({ note: 'checked' });
+  assert.equal(error.textContent, 'You shipped work linked to this criterion, so someone else has to sign it off.');
+  const last = await render({ uatPost: { status: 201, ok: true, data: { ok: true, criterion_closed: true, achieved_goals: [7] } } });
+  await last.submitForm({ note: 'checked' });
+  assert.ok(last.calls.toasts.some((t) => /goal is achieved/.test(t)), JSON.stringify(last.calls.toasts));
 });
 
 summary();

package/tests/goal_map_page.mjs

@@ -427,7 +427,8 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<h1>the sky <em id="lensWord">— the whole project<\/em><\/h1>/, 'the h1 is in static markup, so every state has one');
   assert.equal(/shell\.js|style\.css/.test(html), false, 'no hall chrome yet — /thinking joined it (task 1004327), the project sky did not');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
-  assert.deepEqual(scripts(html).map((s) => s[0]), ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
+  assert.deepEqual(scripts(html).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // /thinking also loads the shell (task 1004327); the SKY's files are the same.
   const skyScripts = (h) => scripts(h).filter((s) => s[0] !== 'shell.js');
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');

package/tests/hall_sky.mjs

@@ -497,4 +497,20 @@ await test('a capped trail is spoken, never a silent slice', async () => {
 });
 
 console.log('');
+await test('a ring carries its UAT state in the goal page words, and says it on hover and in the panel (task 1004402)', async () => {
+  const w = well({ criteria: [
+    { id: '70', criterion_id: 'c1', criterion_md: 'Awaiting ring', satisfied: false, pending_review: true, uat_state: 'awaiting_uat', backend_only: true, task_ids: ['500'] },
+    { id: '71', criterion_id: 'c2', criterion_md: 'Closed ring', satisfied: true, pending_review: false, uat_state: 'closed_before_uat', task_ids: ['500'] },
+    { id: '72', criterion_id: 'c3', criterion_md: 'Open ring', satisfied: false, pending_review: false, uat_state: 'open', task_ids: ['501'] },
+  ] });
+  const p = await boot({ sky: sky([w]) });
+  const crit = p.S().goals[0].crit;
+  assert.equal(crit[0].uatLabel, 'Awaiting UAT');
+  assert.equal(crit[0].backendOnly, true);
+  assert.equal(crit[1].uatLabel, 'Closed before UAT', 'every state, not only awaiting');
+  assert.equal(crit[2].uatLabel, null, 'an open ring needs no word: its open ring already says so');
+  const src = FS.readFileSync('modules/hall-ui/public/sky-interaction.js', 'utf8') + FS.readFileSync('modules/hall-ui/public/sky-panel.js', 'utf8');
+  assert.equal((src.match(/esc\(c\.uatLabel\)/g) || []).length, 2, 'the hover card and the panel both print the label, escaped');
+});
+
 summary();

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-09-30-commands/);
+    assert.match(HTML, /shell\.js\?v=2026-09-30-founding-commands/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/helpers.mjs

@@ -767,7 +767,9 @@ export const settle = () => new Promise((r) => setTimeout(r, 0));
 // carry the same markup and the same scripts and differ in the body's
 // `data-sky-lens` (which lens is home). A test names the `page`; each is parsed
 // from its OWN file, so a button lost from either one fails.
-const SKY_FILES = ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js'];
+// criterion-uat-ui.js (task 1004402): both sky pages load it before sky-data,
+// which reads the rings' UAT state words from it.
+const SKY_FILES = ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js'];
 const SKY_SRC = SKY_FILES.map((f) => [f, fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', f), 'utf8')]);
 const SKY_PAGES = {};
 function skyPage(page) {

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '4e14115a3737db9a';
+const SHELL_SHA = '3e4f905947bc39d2';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/sky_read.mjs

@@ -54,7 +54,8 @@ await test('the shape: wells carry their criteria and their compact tasks; edges
   assert.deepEqual(Object.keys(w1).sort(), ['category', 'created_at', 'criteria', 'goal_id', 'status', 'subtitle', 'task_done', 'task_total', 'tasks', 'title', 'version_id']);
   assert.equal(w1.subtitle, 'sub 1');
   assert.equal(w1.created_at, '2026-09-01T00:00:00.000Z');
-  assert.deepEqual(w1.criteria, [{ id: '10', criterion_id: 'slug-10', criterion_md: 'Criterion 10', satisfied: false, task_ids: ['100', '101'], pending_review: false }]);
+  // task 1004402: each ring also carries its UAT state + backend-only flag (ADR 0351).
+  assert.deepEqual(w1.criteria, [{ id: '10', criterion_id: 'slug-10', criterion_md: 'Criterion 10', satisfied: false, backend_only: false, task_ids: ['100', '101'], pending_review: false, uat_state: 'open' }]);
   assert.deepEqual(w1.tasks[0], { id: '100', title: 'Task 100', status: 'shipped', credits_reward: 30, created_on: '2026-09-02', idea_id: '555' });
   assert.equal(w1.tasks[1].idea_id, null, 'a task not born of an idea carries null, not an empty string');
   assert.deepEqual(out.goals[1].criteria[0].task_ids, [], 'a criterion with no linked task is an empty ring, not a missing one');
@@ -79,6 +80,11 @@ await test('pending_review is derived the way the rollup derives it: every linke
   assert.equal(by['10'].pending_review, true, 'shipped + abandoned: abandoned is terminal, so nothing remains');
   assert.equal(by['11'].pending_review, false, 'an active task still gates it');
   assert.equal(by['12'].pending_review, true, 'all-abandoned DOES surface for review — the review flag is deliberately wider than auto-close (task 1002651, ADR 0183), and the sky must not narrow it');
+  // task 1004402 (ADR 0351): the UAT state is the NARROWER question — delivered
+  // work waiting for a sign-off. An all-abandoned ring delivered nothing to test.
+  assert.equal(by['10'].uat_state, 'awaiting_uat');
+  assert.equal(by['11'].uat_state, 'open');
+  assert.equal(by['12'].uat_state, 'open', 'all-abandoned is flagged for a person, never awaiting a UAT');
   assert.equal(by['13'].pending_review, false, 'already satisfied');
   assert.equal(by['13'].satisfied, true);
 });