@bongos/core 1.20.47 → 1.20.49

package/modules/hall-ui/records/founding-mode.md

@@ -0,0 +1,31 @@
+# Project founding mode — the band and the asleep rooms, worn by the existing hall (task 1004422)
+
+**BV2.PS03 (goal 1000121).**
+- Design of record: [`docs/design/project-startup-direction.md`](../../../docs/design/project-startup-direction.md), part 2 of the genesis table.
+- Spec: [`docs/specs/<redacted>.md`](../../../docs/specs/<redacted>.md).
+
+## The rule this record exists to keep
+
+The owner's blend rule: **genesis is a MODE the existing hall wears, never a second hall.** Founding mode follows the social-mode precedent exactly: one attribute on the document, `html[data-founding="on"]`, read from `/me`. It adds two things in this task:
+
+- **the founding band**, a strip created as the first child of `.app-body`. It sits above the sticky topbar, which is kept as it is.
+- **the asleep state on today's nav items**: dimmed, with an "at <stage>" or "when alive" tag that reads in the open rail.
+
+Nothing else changes: no new page, no new route, no new nav item. **A project that is not founding makes `applyFounding` return before it touches a single node**, and `tests/founding_mode.mjs` proves that with a proxy that records every DOM call. Switching the mode off REMOVES the band and every class and tag, so the hall is restored exactly; it does not merely hide them. It is cosmetic: an asleep room still opens, and nothing is enforced.
+
+## Where the answer comes from
+
+- `modules/onboarding/founding-mode.js` holds three `project_settings` keys (`founding.active`, `founding.stage`, `founding.started_at`) and computes which rooms sleep.
+- `asleep` is keyed by `shell.js` NAV ids, so the client never re-derives it. A test holds the two maps together.
+- It **fails closed to OFF**: an absent, unreadable or unknown stage reads as not founding. A hall wrongly stuck asleep would be the hijack; a hall wrongly awake only loses a banner.
+- `/me.founding_mode` carries the answer. Both `applyAccess` callers pass it (`shell.js` `probeMe` and `hall-render.js`).
+
+## Rendered, and the phone rule
+
+work-founding.states.json renders an ordinary hall page with a founding /me (kit fixture me-founding.json, the real shaper's output). The kit's /me honours stub.fixtures for this. At 390 and 320 the band wraps, the sentence steps aside and the stage and link stay visible, because the first render measured the band widening the page to 483px.
+
+## What is deliberately not here
+
+- The genesis home, the stage tasks and the "what's this?" destination belong to PS08 (task 1004423). The band links home until then.
+- The founding mark belongs to PS10 (task 1004424).
+- Starting founding on a new project and moving its stage is `setFoundingMode`, on the onboarding port, and PS08 drives it. Nothing in this task writes it.

package/modules/lifecycle/done-when.js

@@ -221,7 +221,9 @@ async function criterionProgress(versionId) {
   // about coverage. It uses idx_tasks_version_status (version_id leading).
   const [{ rows }, { rows: unattr }, goalRows] = await Promise.all([
     pool.query(
-      `WITH ranked AS (
+      // MATERIALIZED (task 1004402): the per-criterion UAT subqueries run once per
+      // criterion here, never once per (criterion, task) row after the join.
+      `WITH ranked AS MATERIALIZED (
          SELECT d.id, d.version_id, d.criterion_id, d.criterion_md, d.satisfied, d.goal_id,
                 ROW_NUMBER() OVER (ORDER BY d.sort_order, d.criterion_id) AS cnum,
                 ${uatReadColumnsSql('d')}

package/modules/lifecycle/sky.js

@@ -42,7 +42,7 @@ const api = require('../../src/module-api');
 const { pool } = api;
 const goalGraph = require('./goal-graph');
 const goalCategory = require('./goal-category');
-const { isPendingReview } = require('./done-when');
+const { isPendingReview, uatState, uatReadColumnsSql } = require('./done-when');
 const { TERMINAL_STATUSES } = require('./task-status');
 
 const SKY_CACHE_TTL_MS = 60 * 1000;
@@ -67,15 +67,24 @@ async function skyRows({ versionId = null, viewerId = null, viewerIsArchon = fal
     activePool.query(
       // The criterion→task join, read once. Flat rows on purpose (see the header):
       // the fold happens in shapeSky so a test can compare it with the rollup's.
-      `SELECT c.id::text AS id, c.goal_id::text AS goal_id, c.criterion_id, c.criterion_md,
-              c.satisfied, c.sort_order,
+      // task 1004402: each criterion's UAT columns (ADR 0351) are read ONCE per
+      // criterion, in a MATERIALIZED step before the task join fans the rows out;
+      // spliced into the flat join they re-ran once per linked task, on the one
+      // read that is the whole project's sky.
+      `WITH crit AS MATERIALIZED (
+         SELECT c.id, c.goal_id, c.criterion_id, c.criterion_md, c.satisfied, c.sort_order,
+                ${uatReadColumnsSql('c')}
+           FROM done_when_criteria c
+           JOIN goals g ON g.id = c.goal_id
+          WHERE c.goal_id IS NOT NULL
+            AND ($1::text IS NULL OR g.version_id = $1)
+       )
+       SELECT c.id::text AS id, c.goal_id::text AS goal_id, c.criterion_id, c.criterion_md,
+              c.satisfied, c.sort_order, c.uat_kind, c.backend_only,
               t.id::text AS task_id, t.status AS task_status
-         FROM done_when_criteria c
-         JOIN goals g ON g.id = c.goal_id
+         FROM crit c
          LEFT JOIN task_criteria tc ON tc.criterion_id = c.id
          LEFT JOIN tasks t          ON t.id = tc.task_id
-        WHERE c.goal_id IS NOT NULL
-          AND ($1::text IS NULL OR g.version_id = $1)
         ORDER BY c.goal_id, c.sort_order, c.criterion_id, t.id`,
       [version]
     ),
@@ -111,21 +120,27 @@ function foldCriteria(rows = []) {
         criterion_id: row.criterion_id,
         criterion_md: row.criterion_md,
         satisfied: row.satisfied === true,
+        backend_only: row.backend_only === true,
         task_ids: [],
         _unshipped: 0,
+        _shipped: 0,
+        _uatKind: row.uat_kind ?? null,
       };
       byId.set(c.id, c);
     }
     if (row.task_id != null) {
       c.task_ids.push(String(row.task_id));
       if (!TERMINAL_STATUSES.includes(row.task_status)) c._unshipped += 1;
+      if (row.task_status === 'shipped') c._shipped += 1;
     }
   }
   return [...byId.values()].map((c) => {
-    const { _unshipped, ...rest } = c;
+    const { _unshipped, _shipped, _uatKind, ...rest } = c;
     return {
       ...rest,
       pending_review: isPendingReview({ satisfied: c.satisfied, linked: c.task_ids.length, unshipped: _unshipped }),
+      // task 1004402: the same derivation the goal page and /status use.
+      uat_state: uatState({ satisfied: c.satisfied, linked: c.task_ids.length, unshipped: _unshipped, shipped: _shipped, latestKind: _uatKind }),
     };
   });
 }

package/modules/onboarding/founding-mode.js

@@ -0,0 +1,185 @@
+'use strict';
+
+// modules/onboarding/founding-mode.js — PROJECT FOUNDING MODE: is this project still
+// being founded, and which stage of genesis is it on? (task 1004422 / BV2.PS03, goal
+// 1000121; design of record docs/design/project-startup-direction.md.)
+//
+// THE BLEND RULE THIS FILE SERVES (owner, 2026-09-30). Genesis is a MODE the existing
+// builders hall wears, never a second hall. So this file answers ONE question for the
+// hall shell — founding or not, and at which stage — and the shell stamps the answer on
+// the document the way it stamps social mode (`html[data-social]`). Nothing here renders
+// anything, and a project that is not founding gets `null`, which the shell reads as OFF:
+// the hall then renders exactly as it does today.
+//
+// WHY THE ONBOARDING MODULE. Founding is the FOUNDER-side counterpart of the joiner
+// state machine this module already owns (onboarding-state.js graduates a newcomer; this
+// graduates a project). It lives in project_settings (migration core_231) through the
+// doorway's one accessor, like mingle.enabled, rather than a table of its own — one row
+// per project is the whole state, and "do not fork a second settings store" is that
+// accessor's own rule.
+//
+// FAIL POSTURE: CLOSED, i.e. OFF. An unreadable, absent, or malformed state is NOT
+// founding. The failure this guards against is the owner's no-hijack condition: a hall
+// wrongly stuck in founding mode would dim rooms that are really open. A hall wrongly
+// NOT in founding mode only loses a banner. So every doubtful read answers null.
+
+// The genesis stages, in order. 'decide' is the pre-stage the founder plans in; the
+// five after it are the stages proper (spec C4). The order IS the data: a room wakes
+// when the stage that wakes it has been left behind.
+const STAGES = Object.freeze(['decide', 'scope', 'strategize', 'charter', 'legalize', 'legislation']);
+
+// Which hall rooms each finished stage wakes (the direction doc's "How rooms wake"
+// table). Keyed by the shell's NAV item ids, so the client applies it without a second
+// mapping of its own — a surface that re-derived this could disagree with the server.
+// 'community' wakes only when the planet is ALIVE, which is when founding mode switches
+// off entirely, so during founding it is always asleep.
+const WAKES = Object.freeze({
+  scope: Object.freeze(['roadmap', 'goals', 'goal-map']),
+  strategize: Object.freeze(['work']),
+  charter: Object.freeze(['board-room']),
+  legalize: Object.freeze(['economy']),
+  legislation: Object.freeze(['ranks']),
+});
+const WAKES_WHEN_ALIVE = Object.freeze(['collab', 'roster']);
+
+// The project_settings keys. Namespaced 'founding.' like 'mingle.' and 'attention.'.
+const KEYS = Object.freeze({
+  ACTIVE: 'founding.active',
+  STAGE: 'founding.stage',
+  STARTED_AT: 'founding.started_at',
+});
+
+// The only 'on' spelling accepted, mirroring mingle's consent-gate parse: an explicit,
+// recognised yes. Anything else is off.
+function parseActive(raw) {
+  if (raw == null) return false;
+  return ['true', '1', 'on', 'yes'].includes(String(raw).trim().toLowerCase());
+}
+
+// asleepRooms(stage) — PURE. For a known stage, { navId: wakingStage } for every room
+// still asleep. A room is awake once its waking stage is BEHIND the current one.
+function asleepRooms(stage) {
+  const at = STAGES.indexOf(stage);
+  if (at < 0) return null;
+  const asleep = {};
+  for (const [wakingStage, ids] of Object.entries(WAKES)) {
+    if (STAGES.indexOf(wakingStage) >= at) for (const id of ids) asleep[id] = wakingStage;
+  }
+  for (const id of WAKES_WHEN_ALIVE) asleep[id] = 'alive';
+  return asleep;
+}
+
+// dayOf(startedAt, now) — PURE. Day 1 is the founding day. null when unreadable, so a
+// bad timestamp drops the day from the band rather than printing "day NaN".
+function dayOf(startedAt, now = new Date()) {
+  if (!startedAt) return null;
+  const t = new Date(startedAt).getTime();
+  if (!Number.isFinite(t)) return null;
+  const days = Math.floor((now.getTime() - t) / 86400000) + 1;
+  return days >= 1 ? days : 1;
+}
+
+// shapeFoundingMode(rows, now) — PURE. rows = { active, stage, startedAt } raw strings
+// (or nulls). Returns the /me payload, or null for "not founding" in any form.
+function shapeFoundingMode(rows, now = new Date()) {
+  if (!rows || !parseActive(rows.active)) return null;
+  const stage = rows.stage == null ? 'decide' : String(rows.stage).trim().toLowerCase();
+  const asleep = asleepRooms(stage);
+  if (!asleep) return null; // an unknown stage is not a stage — fail closed (OFF)
+  const index = STAGES.indexOf(stage);
+  return {
+    active: true,
+    stage,
+    // 0 while deciding, then 1..5 through the stages proper.
+    stage_number: index,
+    stage_count: STAGES.length - 1,
+    day: dayOf(rows.startedAt, now),
+    asleep,
+    // Who closing the current stage is waiting on (spec D7) — display names, at most
+    // five, from the government module's genesis-stage sitting (task 1004429). null
+    // when the stage is not sitting, nobody is left to vote, or the read is missing.
+    waiting_on: Array.isArray(rows.waitingOn) && rows.waitingOn.length
+      ? rows.waitingOn.slice(0, 5).map((n) => String(n))
+      : null,
+  };
+}
+
+// foundingModeFor(deps) — the /me read. Resolves the three rows through the doorway's
+// project-settings accessor (injectable for tests). Never throws: any read failure is
+// "not founding".
+// Three primary-key reads in parallel: the doorway's project-settings accessor is
+// single-key by design (one accessor, one table), and a founding project is a short
+// window of a project's life, so a batched read is not worth a second accessor.
+async function foundingModeFor(deps = {}) {
+  const get = deps.getSetting || require('../../src/module-api').projectSettings.get;
+  let shaped;
+  try {
+    const [active, stage, startedAt] = await Promise.all([
+      get(KEYS.ACTIVE), get(KEYS.STAGE), get(KEYS.STARTED_AT),
+    ]);
+    shaped = shapeFoundingMode({
+      active: active && active.value,
+      stage: stage && stage.value,
+      startedAt: startedAt && startedAt.value,
+    }, deps.now || new Date());
+  } catch (_) {
+    return null;
+  }
+  if (!shaped) return null;
+  // The waiting-on names come from the government module's genesis-stage read
+  // (genesisStageStatus on its port, task 1004429: one entry per stage, each with
+  // a state and, while sitting, the members still to vote under the item's own
+  // snapshot). Optional and fail-open: a missing port or a failed read leaves the
+  // band without the names, never without the mode.
+  try {
+    const waitingOnFor = deps.waitingOnFor || waitingOnFromGovernment(
+      deps.government !== undefined ? deps.government : require('../../src/module-api').resolveOptional('government'),
+    );
+    if (waitingOnFor) {
+      const names = await waitingOnFor(shaped.stage);
+      if (Array.isArray(names) && names.length) shaped.waiting_on = names.slice(0, 5).map((n) => String(n));
+    }
+  } catch (_) { /* fail open: the band shows the stage without the names */ }
+  return shaped;
+}
+
+// waitingOnFromGovernment(gov) — a stage -> [display name] reader over the government
+// port's genesisStageStatus(), or null when the port does not offer it. Only a stage
+// that is SITTING waits on anyone; not_put, passed and returned wait on nobody.
+function waitingOnFromGovernment(gov) {
+  if (!gov || typeof gov.genesisStageStatus !== 'function') return null;
+  return async (stage) => {
+    const status = await gov.genesisStageStatus();
+    const row = status && Array.isArray(status.stages) ? status.stages.find((s) => s.key === stage) : null;
+    if (!row || row.state !== 'sitting' || !Array.isArray(row.waiting_on)) return [];
+    return row.waiting_on.map((m) => m.display_name || m.github_login).filter(Boolean);
+  };
+}
+
+// setFoundingMode({ active, stage }, builderId, deps) — the write the genesis home
+// (task 1004423) drives: start founding on a new project, move the stage, and switch
+// founding off when the planet comes alive. Refuses an unknown stage rather than storing
+// a value the read would then treat as OFF. Starting stamps started_at once.
+async function setFoundingMode({ active, stage } = {}, builderId = null, deps = {}) {
+  const settings = require('../../src/module-api').projectSettings;
+  const get = deps.getSetting || settings.get;
+  const set = deps.setSetting || settings.set;
+  if (stage != null && !STAGES.includes(stage)) {
+    const err = new Error(`unknown founding stage '${stage}'`);
+    err.code = 'bad_founding_stage';
+    throw err;
+  }
+  if (active === true) {
+    const started = await get(KEYS.STARTED_AT);
+    if (!started || !started.value) await set(KEYS.STARTED_AT, (deps.now || new Date()).toISOString(), builderId);
+  }
+  if (typeof active === 'boolean') await set(KEYS.ACTIVE, active ? 'true' : 'false', builderId);
+  if (stage != null) await set(KEYS.STAGE, stage, builderId);
+  return foundingModeFor({ getSetting: get, now: deps.now });
+}
+
+module.exports = {
+  STAGES, WAKES, WAKES_WHEN_ALIVE, KEYS,
+  parseActive, asleepRooms, dayOf, shapeFoundingMode, waitingOnFromGovernment,
+  foundingModeFor, setFoundingMode,
+};

package/modules/onboarding/port.js

@@ -40,6 +40,7 @@
 
 const onboardingState = require('./onboarding-state');
 const newcomerRestock = require('./newcomer-restock');
+const foundingMode = require('./founding-mode');
 
 module.exports = {
   // --- the newcomer onboarding state machine (onboarding-state.js) ---------
@@ -53,6 +54,12 @@ module.exports = {
   markStage: (...a) => onboardingState.markStage(...a),
   broadcastGraduation: (...a) => onboardingState.broadcastGraduation(...a),
 
+  // --- project founding mode (founding-mode.js, task 1004422) ---------------
+  // me.js reads it for the hall shell (null = not founding = the hall as today);
+  // the genesis home (task 1004423) drives the write.
+  foundingModeFor: (...a) => foundingMode.foundingModeFor(...a),
+  setFoundingMode: (...a) => foundingMode.setFoundingMode(...a),
+
   // --- the evergreen newcomer-chore restock (newcomer-restock.js) ----------
   // restock the just-claimed chore's shelf (claims.js / tasks.js); the Archon
   // backstop tops every chore up (tasks.js). SOURCE_TAG is the marker the claim

package/modules/ui-design/kit/fixtures/me-founding.json

@@ -0,0 +1,24 @@
+{
+  "builder": {
+    "id": "1",
+    "github_login": "builder",
+    "display_name": "A Builder",
+    "avatar_url": "/__kit/avatar.svg",
+    "rank": "archon"
+  },
+  "founding_mode": {
+    "active": true,
+    "stage": "strategize",
+    "stage_number": 2,
+    "stage_count": 5,
+    "day": 9,
+    "asleep": {
+      "work": "strategize",
+      "board-room": "charter",
+      "economy": "legalize",
+      "ranks": "legislation",
+      "collab": "alive",
+      "roster": "alive"
+    }
+  }
+}

package/modules/ui-design/kit/serve.js

@@ -277,7 +277,9 @@ function fileUnder(base, rel) {
 // is absolutised to this origin per request.
 const AVATAR_SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64"><circle cx="32" cy="32" r="32" fill="#888"/><circle cx="32" cy="26" r="11" fill="#ddd"/><path d="M12 56c3-12 11-17 20-17s17 5 20 17" fill="#ddd"/></svg>';
 function me(origin) {
-  const m = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'me.json'), 'utf8'));
+  // stub.fixtures may re-point the identity too (task 1004422: the founding-mode render) —
+  // the same ALIAS every other fixture honours, so a variant states file needs no stub code.
+  const m = JSON.parse(fs.readFileSync(path.join(FIXTURES, (ALIAS.me || 'me') + '.json'), 'utf8'));
   if (m.builder && typeof m.builder.avatar_url === 'string' && m.builder.avatar_url.startsWith('/')) m.builder.avatar_url = origin + m.builder.avatar_url;
   return m;
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.47",
+  "version": "1.20.49",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.47",
+      "version": "1.20.49",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.47",
+  "version": "1.20.49",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8395,5 +8395,17 @@
       "id": "1003141",
       "text": "The Goals page now has the same bulk actions as the Tasks board: claim several tasks, release your own, or copy a prompt to work them in parallel or in order. Both pages now share one toolbar, so they stay in step."
     }
+  ],
+  "1.20.48": [
+    {
+      "id": "1004422",
+      "text": "While a new project is being founded, its builders hall now shows a clear \"project founding mode\" band at the top and dims the rooms that open later. A hall that isn't being founded stays exactly as it was."
+    }
+  ],
+  "1.20.49": [
+    {
+      "id": "1004402",
+      "text": "A goal's page now shows where each checklist item really stands: Awaiting UAT, Satisfied, or Closed before UAT, with a Backend-only tag where there is nothing to record. The old Confirm button is gone. Instead, an item whose w"
+    }
   ]
 }

package/scripts/hall-preview/server.js

@@ -105,6 +105,8 @@ const FIXTURE_FALLBACKS = [
   [/^goals\/\d+\/dependency-forest$/, 'goals__dependency-forest'],
   [/^goals\/\d+\/requests$/, 'goals__requests'],
   [/^goals\/\d+$/, 'goals__detail'],
+  // a criterion's UAT panel (task 1004402): one Awaiting UAT reading serves any id.
+  [/^done-when\/\d+\/uat$/, 'done-when__uat'],
   [/^tasks\/\d+$/, 'tasks__detail'],
   // the #/idea/N + #/blocker/N deep-link overlay (task-detail.js) — one record
   // fixture serves any id so the overlay seam assertion renders real content.

package/src/bongos/routes/me.js

@@ -187,7 +187,7 @@ module.exports = function buildMeRouter() {
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
-      navPermissions,
+      navPermissions, foundingMode,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -308,6 +308,16 @@ module.exports = function buildMeRouter() {
       // Same fan-out slot as the reads above, but it fails CLOSED rather than
       // open — null hides the link. See navPermissionsFor.
       navPermissionsFor(req.builder.id),
+      // task 1004422 (BV2.PS03): PROJECT FOUNDING MODE — is this project still being
+      // founded, and at which genesis stage. Same fan-out slot and posture as social
+      // mode: null (not founding, or unreadable) is OFF, and the hall then renders
+      // exactly as it does today, which is the owner's no-hijack condition.
+      (async () => {
+        try {
+          if (!onboarding || !onboarding.foundingModeFor) return null;
+          return await onboarding.foundingModeFor();
+        } catch (_) { return null; }
+      })(),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -378,6 +388,13 @@ module.exports = function buildMeRouter() {
       // when lifecycle is disabled or the read failed, and the shell treats null
       // as OFF — a mode that cannot be read is not on.
       social: socialMode,
+      // task 1004422 (BV2.PS03, goal 1000121): PROJECT FOUNDING MODE. Genesis is a
+      // mode the EXISTING hall wears (the blend rule, docs/design/project-startup-
+      // direction.md), so it rides /me exactly like social: the shell stamps
+      // html[data-founding], draws the founding band and dims the rooms still asleep.
+      // Shape: { active, stage, stage_number, stage_count, day, asleep: {navId: stage} },
+      // or null — and null is OFF, the hall as today.
+      founding_mode: foundingMode,
       // task 1003744: { '<atom>': boolean } for each permission key a hall nav
       // item may gate on (NAV_PERMISSION_ATOMS above), so an item can declare the
       // SAME atom its page is gated on instead of borrowing the nearest rank

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.47'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.49'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claim_action.mjs

@@ -401,8 +401,13 @@ await test('the cache-bust moved on every page whose script changed', () => {
     ['goals.html', ['goals-render.js', 'goals-page.js']],
   ]) {
     const html = read('modules', 'hall-ui', 'public', page);
+    // The invariant is "busted AT OR AFTER the claim-action change", not the
+    // literal stamp: a later change to the same script bumps it again (task
+    // 1004402 did), and a pin on the string would fail that correct bump.
     for (const s of scripts) {
-      assert.match(html, new RegExp(s.replace('.', '\\.') + '\\?v=2026-09-30-bulktoolbar'), `${page}: ${s} not busted`);
+      const m = new RegExp(s.replace('.', '\\.') + '\\?v=(\\d{4}-\\d{2}-\\d{2})').exec(html);
+      assert.ok(m, `${page}: ${s} carries no dated cache-bust`);
+      assert.ok(m[1] >= '2026-09-26', `${page}: ${s} not busted since the claim-action change (${m[1]})`);
     }
   }
 });

package/tests/criterion_uat_ui.mjs

@@ -0,0 +1,113 @@
+// tests/criterion_uat_ui.mjs — the hall's criterion UAT helpers (task 1004402,
+// ADR 0351), DB-free and DOM-free. The page-level wiring is driven for real in
+// tests/goal_criterion_confirm_ui.mjs; this file pins the vocabulary and the
+// panel's variations.
+//
+//   1. The labels equal the server's (modules/lifecycle/criterion-uat.js
+//      stateLabel), so the hall, /status and /goal-uat say the same thing. The
+//      browser cannot require server code, so this is the lockstep.
+//   2. The backend-only switch appears only where it can work: an OPEN criterion,
+//      in the full view, for a reviewer, on a server that knows the rule.
+//   3. The panel asks for what the server will require and nothing else: the
+//      attestation only where the site cannot read its own deploy; no file field
+//      on a backend-only criterion; no form for a viewer who cannot sign.
+//   4. A stale sign-off is said to no longer count, never shown as the UAT.
+//
+// Run:  node tests/criterion_uat_ui.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ui = require('../modules/hall-ui/public/criterion-uat-ui.js');
+const server = require('../modules/lifecycle/criterion-uat.js');
+const { test, summary } = makeRunner();
+
+await test('LABELS: every server state has the same words in the hall', () => {
+  for (const state of Object.values(server.UAT_STATES)) {
+    assert.equal(ui.STATE_LABELS[state], server.stateLabel(state), state);
+  }
+  assert.equal(Object.keys(ui.STATE_LABELS).length, Object.values(server.UAT_STATES).length, 'no hall-only state');
+});
+
+await test('STATE: an older server with no uat_state reads plainly and never as a UAT state', () => {
+  assert.equal(ui.stateOf({ satisfied: true }), 'legacy_satisfied');
+  assert.equal(ui.stateOf({ satisfied: false }), 'open');
+  assert.equal(ui.badgesHtml({ satisfied: true }), '');
+  assert.equal(ui.actionHtml({ id: 1, satisfied: true }, { canReview: true, full: true }), '');
+});
+
+await test('BACKEND-ONLY SWITCH: only on an OPEN criterion, in the full view, for a reviewer', () => {
+  const open = { id: 9, uat_state: 'open', satisfied: false };
+  assert.match(ui.actionHtml(open, { canReview: true, full: true }), /data-uat-backend="9" data-on="1"/);
+  assert.match(ui.actionHtml({ ...open, backend_only: true }, { canReview: true, full: true }), /data-on="0"[^>]*>Not backend-only/);
+  assert.equal(ui.actionHtml(open, { canReview: true, full: false }), '', 'not in the capped band: it is an authoring act');
+  assert.equal(ui.actionHtml(open, { canReview: false, full: true }), '');
+  assert.doesNotMatch(ui.actionHtml({ id: 9, uat_state: 'awaiting_uat' }, { canReview: true, full: true }), /data-uat-backend/,
+    'once awaiting, the server refuses it, so the page does not offer it');
+});
+
+const VIEW = (over = {}) => ({
+  criterion: { id: 42 },
+  uat_state: 'awaiting_uat',
+  backend_only: false,
+  checks: { code: true, live: { available: false }, uat: null, stale_uat: null },
+  ...over,
+});
+
+await test('PANEL: a site that cannot read its deploy asks for the attestation; one that can, does not', () => {
+  const blind = ui.panelHtml(VIEW(), { apiBase: '/api/bongos', canReview: true });
+  assert.match(blind, /data-uat-attest="42"/);
+  assert.match(blind, /data-uat-file="42"/);
+  const seeing = ui.panelHtml(VIEW({ checks: { code: true, live: { available: true, live: true }, uat: null } }), { apiBase: '/api/bongos', canReview: true });
+  assert.doesNotMatch(seeing, /data-uat-attest/);
+  assert.match(seeing, /Running on the live site\./);
+});
+
+await test('PANEL: not live yet names the tasks, in plain words', () => {
+  const html = ui.panelHtml(VIEW({ checks: { code: true, live: { available: true, live: false, not_live: [{ task_id: '12' }] }, uat: null } }), { apiBase: '', canReview: true });
+  assert.match(html, /not on the live site yet \(#12\)/);
+});
+
+await test('PANEL: a backend-only criterion has no file field and asks how it was checked', () => {
+  const html = ui.panelHtml(VIEW({ backend_only: true }), { apiBase: '', canReview: true });
+  assert.doesNotMatch(html, /data-uat-file/);
+  assert.match(html, /How you checked it/);
+  assert.match(html, />Sign off</);
+});
+
+await test('PANEL: a viewer who cannot sign sees the checks and no form', () => {
+  const html = ui.panelHtml(VIEW(), { apiBase: '', canReview: false });
+  assert.match(html, /uat-checks/);
+  assert.doesNotMatch(html, /data-uat-form/);
+});
+
+await test('PANEL: a stale sign-off is said to no longer count, and its recording still plays', () => {
+  const stale = { kind: 'uat', signed_off_by_login: 'ana', created_at: '2026-09-20T10:00:00Z', recording_file: 'uat-42-0123456789abcdef.mp4' };
+  const html = ui.panelHtml(VIEW({ checks: { code: true, live: { available: false }, uat: null, stale_uat: stale } }), { apiBase: '/api/bongos', canReview: true });
+  assert.match(html, /no longer counts: more work shipped after it/);
+  assert.match(html, /<video class="uat-video" controls preload="metadata" src="\/api\/bongos\/criterion-uats\/recordings\/uat-42-0123456789abcdef\.mp4">/);
+});
+
+await test('PANEL: a closed criterion shows who signed it and when, and offers no form', () => {
+  const html = ui.panelHtml(VIEW({ uat_state: 'satisfied_uat', checks: { code: true, live: null, uat: { kind: 'uat', signed_off_by_login: 'ana', created_at: '2026-09-28T10:00:00Z', note: 'made a rank' } } }), { apiBase: '', canReview: true });
+  assert.match(html, /Tried on the live site by ana/);
+  assert.match(html, /made a rank/);
+  assert.doesNotMatch(html, /data-uat-form/);
+});
+
+await test('ESCAPING: a note or a login can never become markup', () => {
+  const html = ui.panelHtml(VIEW({ uat_state: 'satisfied_uat', checks: { code: true, uat: { kind: 'uat', signed_off_by_login: '<b>x</b>', created_at: '2026-09-28', note: '"><script>alert(1)</script>' } } }), { apiBase: '', canReview: false });
+  assert.doesNotMatch(html, /<script>|<b>x<\/b>/);
+});
+
+await test('REFUSALS: the server\'s sentence wins; the fallbacks are plain words', () => {
+  assert.equal(ui.refusalText({ error: { code: 'work_not_live', message: 'Some of this work is not deployed yet.' } }, 409), 'Some of this work is not deployed yet.');
+  assert.match(ui.refusalText({}, 413), /100 MB cap/);
+  assert.match(ui.refusalText(null, 500), /did not go through \(500\)/);
+  assert.equal(ui.checkFile({ type: 'video/webm', size: 5 }), null);
+  assert.equal(ui.checkFile(null), 'Choose the recording first.');
+});
+
+summary();