@bongos/core 1.20.48 → 1.20.50

package/tests/goal_criterion_confirm_ui.mjs

@@ -1,4 +1,6 @@
-// tests/goal_criterion_confirm_ui.mjs — in-hall criterion confirmation (task 1002164).
+// tests/goal_criterion_confirm_ui.mjs — in-hall criterion confirmation (task 1002164),
+// now the in-hall UAT (task 1004402, ADR 0351): the bare Confirm button (a POST
+// /satisfy) is gone, and a criterion awaiting UAT is tested and signed off here.
 //
 // The goal's bx-hall criterion says core task actions must work in the builders
 // hall WITHOUT invoking the LLM. Criterion confirmation violated that: the goal
@@ -47,20 +49,39 @@ const GOALS_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/go
 const GOAL_FOREST_RENDER_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goal-forest-render.js'), 'utf8');
 const GOALS_RENDER_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-render.js'), 'utf8');
 
+const UAT_UI_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/criterion-uat-ui.js'), 'utf8');
+
 const { test, summary } = makeRunner();
 
+// task 1004402: the server sends each criterion's UAT state (ADR 0351). The
+// "legacy" set is a server too old to send it.
 const CRIT = {
-  satisfied: { id: 501, criterion_id: 'c-done', criterion_md: 'Already confirmed', satisfied: true, pending_review: false },
-  pending: { id: 502, criterion_id: 'c-pending', criterion_md: 'All its tasks shipped', satisfied: false, pending_review: true },
-  open: { id: 503, criterion_id: 'c-open', criterion_md: 'Still has open work', satisfied: false, pending_review: false },
+  satisfied: { id: 501, criterion_id: 'c-done', criterion_md: 'Already confirmed', satisfied: true, pending_review: false, uat_state: 'satisfied_uat' },
+  pending: { id: 502, criterion_id: 'c-pending', criterion_md: 'All its tasks shipped', satisfied: false, pending_review: true, uat_state: 'awaiting_uat', awaiting_uat: true },
+  open: { id: 503, criterion_id: 'c-open', criterion_md: 'Still has open work', satisfied: false, pending_review: false, uat_state: 'open' },
 };
+const LEGACY = Object.values(CRIT).map(({ uat_state, awaiting_uat, ...c }) => c);
+
+// A fake element the UAT wiring can query: data-* lookups answer from `parts`.
+function fakeNode(parts = {}) {
+  return {
+    dataset: {}, hidden: false, textContent: '', disabled: false, isConnected: true, children: [],
+    querySelector: (sel) => {
+      for (const [k, v] of Object.entries(parts)) if (sel.includes(k)) return v;
+      return null;
+    },
+    appendChild(child) { this.children.push(child); return child; },
+    setAttribute() {},
+    closest() { return null; },
+  };
+}
 
 // Boot goals-page.js against a fake API and return what it rendered + recorded.
 // `rank` drives the client-side control gate; `goalStatus` drives the goal state.
-async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), satisfyResponse, criterionlessTaskCount } = {}) {
-  const calls = { requests: [], toasts: [] };
+async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), criterionlessTaskCount, uatPost, uatView, upload } = {}) {
+  const calls = { requests: [], toasts: [], fetches: [] };
   const els = new Map();
-  const listeners = new Map(); // selector -> [handler]
+  const listeners = new Map(); // selector -> { click: [], submit: [] }
 
   const makeEl = (key) => {
     const el = {
@@ -68,11 +89,10 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
       innerHTML: '',
       classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
       setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
-      appendChild() {}, focus() {}, click() {}, querySelectorAll() { return []; },
+      appendChild() {}, focus() {}, click() {}, querySelectorAll() { return []; }, querySelector() { return null; },
       addEventListener(type, fn) {
-        if (type !== 'click') return;
-        if (!listeners.has(key)) listeners.set(key, []);
-        listeners.get(key).push(fn);
+        if (!listeners.has(key)) listeners.set(key, { click: [], submit: [] });
+        if (listeners.get(key)[type]) listeners.get(key)[type].push(fn);
       },
     };
     return el;
@@ -87,18 +107,17 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const detail = { goal, members: [], criteria, dependencies: [], criterionless_task_count: criterionlessTaskCount };
 
   const api = {
-    request(method, p) {
-      calls.requests.push([method, p]);
-      const reply = (data, status = 200) => Promise.resolve({ status, ok: true, data });
+    request(method, p, opts) {
+      calls.requests.push([method, p, opts && opts.body]);
+      const reply = (data, status = 200) => Promise.resolve({ status, ok: status < 400, data });
       if (method === 'GET' && /\/me$/.test(p)) return reply({ builder: { id: 1, rank }, active_claims: [] });
       if (method === 'GET' && /\/goals$/.test(p)) return reply({ goals: [goal] });
       if (method === 'GET' && /\/goals\/7$/.test(p)) return reply(detail);
       if (method === 'GET' && /\/tasks\?/.test(p)) return reply({ tasks: [] });
       if (method === 'GET' && /\/conflicts$/.test(p)) return reply({ pairs: [] });
       if (method === 'GET' && /\/requests$/.test(p)) return reply({ requests: [] });
-      if (method === 'POST' && /\/done-when\/\d+\/satisfy$/.test(p)) {
-        return Promise.resolve(satisfyResponse || { status: 200, ok: true, data: { criterion: {}, goal_achieved: false, goal: null } });
-      }
+      if (method === 'GET' && /\/done-when\/\d+\/uat$/.test(p)) return Promise.resolve(uatView || reply({ criterion: { id: 502 }, uat_state: 'awaiting_uat', backend_only: false, checks: { code: true, live: { available: false }, uat: null } }));
+      if (method === 'POST' && /\/done-when\/\d+\/uat$/.test(p)) return Promise.resolve(uatPost || { status: 201, ok: true, data: { ok: true, criterion_closed: true, achieved_goals: [] } });
       return reply({});
     },
   };
@@ -146,11 +165,17 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
     getElementById: (id) => $(`#${id}`),
     querySelector: (sel) => $(sel),
     querySelectorAll: () => [],
-    createElement: () => makeEl('created'),
+    createElement: () => ({ ...makeEl('created'), remove() {} }),
     addEventListener() {},
   };
+  // The recording upload is a raw fetch (the API client only speaks JSON).
+  const fetchStub = async (url, init) => {
+    calls.fetches.push([url, init]);
+    const out = upload || { status: 201, body: { ok: true, recording: 'uat-502-0123456789abcdef.webm' } };
+    return { ok: out.status < 400, status: out.status, json: async () => out.body };
+  };
 
-  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
+  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise, fetch: fetchStub, CSS: { escape: (s) => String(s) } };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   // task 1003458: the page loads claim-action.js before this script; the stub
@@ -161,37 +186,62 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/bulk-toolbar.js'), 'utf8'), sandbox, { filename: 'bulk-toolbar.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
   vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });
+  // task 1004402: criterion-uat-ui.js loads before goals-render.js (goals.html).
+  vm.runInContext(UAT_UI_SRC, sandbox, { filename: 'criterion-uat-ui.js' });
   vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).
-  for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0));
-
-  const clickConfirm = async (critId) => {
-    const handlers = listeners.get('#goal-completion-body') || [];
-    assert.ok(handlers.length > 0, 'a click listener must be wired on the completion band');
-    const btn = { disabled: false, textContent: 'Confirm', dataset: { confirmCrit: String(critId) } };
-    const ev = {
-      target: { closest: (sel) => (sel === '[data-confirm-crit]' ? btn : null) },
-      preventDefault() {},
-    };
-    for (const fn of handlers) fn(ev);
-    for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0));
-    return btn;
+  const settle = async () => { for (let i = 0; i < 25; i++) await new Promise((r) => setTimeout(r, 0)); };
+  await settle();
+
+  const band = () => listeners.get('#goal-completion-body') || { click: [], submit: [] };
+
+  // Click "Test and sign off" on a criterion: the panel is appended to its row.
+  const openPanel = async (critId) => {
+    const row = fakeNode({});
+    const btn = { dataset: { uatOpen: String(critId) }, setAttribute() {}, closest: (sel) => (sel === '.crit' ? row : null) };
+    assert.ok(band().click.length > 0, 'a click listener must be wired on the completion band');
+    for (const fn of band().click) fn({ target: { closest: (sel) => (sel === '[data-uat-open]' ? btn : null) }, preventDefault() {} });
+    await settle();
+    return row;
+  };
+
+  // Submit a sign-off form: `file` given (even null = none chosen) = a UAT form
+  // with its file input; omitted = a backend sign-off form, which has none.
+  const submitForm = async ({ critId = 502, file, note = '', attest = null }) => {
+    const error = { hidden: true, textContent: '' };
+    const submitBtn = { disabled: false, textContent: 'Sign off', isConnected: true };
+    const parts = { 'button[type="submit"]': submitBtn, '[data-uat-note]': { value: note } };
+    if (file !== undefined) parts['[data-uat-file]'] = { files: file ? [file] : [] };
+    if (attest !== null) parts['[data-uat-attest]'] = { checked: attest };
+    const form = { ...fakeNode(parts), dataset: { uatForm: String(critId) } };
+    documentObj.querySelector = (sel) => (sel.includes('data-uat-error') ? error : $(sel));
+    const root = els.get('#goal-completion-body');
+    root.querySelector = (sel) => (sel.includes('data-uat-error') ? error : null);
+    for (const fn of band().submit) fn({ target: { closest: (sel) => (sel === '[data-uat-form]' ? form : null) }, preventDefault() {} });
+    await settle();
+    return { error, submitBtn };
   };
 
-  return { calls, band: $('#goal-completion-body').innerHTML, full: $('#goal-completion-full').innerHTML, clickConfirm };
+  return {
+    calls,
+    band: $('#goal-completion-body').innerHTML,
+    full: $('#goal-completion-full').innerHTML,
+    openPanel, submitForm,
+  };
 }
 
+const posts = (calls, re) => calls.requests.filter(([m, p]) => m === 'POST' && re.test(p));
+
 // =========================================================================
-// The three criterion states
+// The criterion states
 // =========================================================================
 
-await test('the goal detail renders all three criterion states distinguishably', async () => {
+await test('the goal detail renders the criterion states distinguishably', async () => {
   const { band } = await render();
-  assert.match(band, /crit--done/, 'a confirmed criterion keeps its done styling');
-  assert.match(band, /crit--pending/, 'a met-but-unconfirmed criterion gets its own state');
-  // The open criterion is the one with neither modifier.
+  assert.match(band, /crit--done/, 'a closed criterion keeps its done styling');
+  assert.match(band, /crit--pending/, 'an awaiting-UAT criterion gets its own state');
   const items = band.match(/<li class="crit[^"]*"/g) || [];
   assert.equal(items.length, 3, `three criteria render — got ${JSON.stringify(items)}`);
   assert.equal(items.filter((s) => /crit--done/.test(s)).length, 1, 'exactly one done');
@@ -199,58 +249,82 @@ await test('the goal detail renders all three criterion states distinguishably',
   assert.equal(items.filter((s) => !/crit--(done|pending)/.test(s)).length, 1, 'exactly one plain/open');
 });
 
-await test('a pending criterion is the ONLY one offering Confirm (Metic)', async () => {
+await test('each state reads in the server\'s own words (Awaiting UAT, Satisfied (UAT))', async () => {
+  const { band } = await render();
+  assert.match(band, /class="crit-state crit-state--awaiting_uat">Awaiting UAT</);
+  assert.match(band, /class="crit-state crit-state--satisfied_uat">Satisfied \(UAT\)</);
+  assert.doesNotMatch(band, /crit-state--open/, 'an open criterion carries no pill: the empty mark already says so');
+});
+
+await test('a Backend-only criterion carries a visible tag', async () => {
+  const { band } = await render({ criteria: [{ ...CRIT.pending, backend_only: true }] });
+  assert.match(band, /class="crit-tag"[^>]*>Backend-only</);
+});
+
+await test('an Awaiting UAT criterion is the ONLY one offering "Test and sign off" (Metic)', async () => {
   const { band } = await render({ rank: 'metic' });
-  const buttons = band.match(/data-confirm-crit="(\d+)"/g) || [];
-  assert.equal(buttons.length, 1, `exactly one Confirm control — got ${JSON.stringify(buttons)}`);
-  assert.match(buttons[0], new RegExp(`"${CRIT.pending.id}"`), 'it targets the pending criterion');
+  const buttons = band.match(/data-uat-open="(\d+)"[^>]*>Test and sign off/g) || [];
+  assert.equal(buttons.length, 1, `exactly one sign-off control — got ${JSON.stringify(buttons)}`);
+  assert.match(buttons[0], new RegExp(`"${CRIT.pending.id}"`), 'it targets the awaiting criterion');
+  assert.match(band, /data-uat-open="501"[^>]*>See the UAT/, 'a UAT-closed criterion offers its evidence instead');
 });
 
-await test('an Archon also gets Confirm (Metic+ means at-or-above, not equals)', async () => {
+await test('an Archon also gets the control (Metic+ means at-or-above, not equals)', async () => {
   const { band } = await render({ rank: 'archon' });
-  assert.match(band, /data-confirm-crit/, 'an Archon outranks Metic and keeps the control');
+  assert.match(band, />Test and sign off</);
 });
 
-await test('a Xenos sees the pending STATE but never the Confirm control', async () => {
+await test('a Xenos sees the Awaiting UAT state but never the sign-off control', async () => {
   const { band } = await render({ rank: 'xenos' });
   assert.match(band, /crit--pending/, 'the state is still visible to everyone');
-  assert.doesNotMatch(band, /data-confirm-crit/, 'the action is hidden below Metic');
-  assert.match(band, /crit__flag/, 'a read-only "Ready" flag stands in for the button');
+  assert.doesNotMatch(band, />Test and sign off</, 'the action is hidden below Metic');
+  assert.match(band, /class="crit__flag"[^>]*>Awaiting UAT</, 'a read-only flag stands in for the button');
 });
 
-await test('a thetes (below Metic) also gets no Confirm control', async () => {
+await test('a thetes (below Metic) also gets no sign-off control', async () => {
   const { band } = await render({ rank: 'thetes' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'thetes is below metic in the ladder');
+  assert.doesNotMatch(band, />Test and sign off</);
 });
 
-await test('an achieved goal offers no Confirm (nothing left to confirm)', async () => {
-  const { band } = await render({ goalStatus: 'achieved' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'a closed goal is not actionable');
+await test('an achieved or archived goal offers no sign-off', async () => {
+  for (const goalStatus of ['achieved', 'archived']) {
+    const { band } = await render({ goalStatus });
+    assert.doesNotMatch(band, />Test and sign off</, goalStatus);
+  }
 });
 
-await test('an archived goal offers no Confirm', async () => {
-  const { band } = await render({ goalStatus: 'archived' });
-  assert.doesNotMatch(band, /data-confirm-crit/, 'an archived goal is not actionable');
+await test('THE BYPASS IS GONE: nothing on the page can POST /satisfy', async () => {
+  for (const criteria of [Object.values(CRIT), LEGACY]) {
+    const { band, full } = await render({ rank: 'archon', criteria });
+    assert.doesNotMatch(band + full, /data-confirm-crit|\/satisfy/, 'no bare Confirm survives, on a new or an old server');
+  }
+  assert.doesNotMatch(SRC, /\/satisfy`/, 'goals-page.js holds no /satisfy call at all');
 });
 
 // =========================================================================
-// The summary line — the /goal-review punt is gone
+// The summary line
 // =========================================================================
 
 await test('the summary no longer sends the builder to the /goal-review CLI skill', async () => {
   const { band } = await render();
-  assert.doesNotMatch(band, /goal-review/, 'the LLM/CLI punt is removed — this is the whole point of the task');
+  assert.doesNotMatch(band, /goal-review/);
 });
 
-await test('the summary counts what is actually ready to confirm', async () => {
+await test('the summary counts what is awaiting UAT', async () => {
   const { band } = await render();
-  assert.match(band, /1 criterion is met and ready to confirm/, 'singular phrasing for one pending criterion');
+  assert.match(band, /1 criterion is awaiting UAT: the work has shipped/, 'singular phrasing for one awaiting criterion');
 });
 
-await test('with nothing pending, the summary explains when a criterion becomes confirmable', async () => {
+await test('with nothing awaiting, the summary explains when a criterion is ready for its UAT', async () => {
   const { band } = await render({ criteria: [CRIT.satisfied, CRIT.open] });
-  assert.doesNotMatch(band, /ready to confirm/, 'no false "ready" claim when nothing is pending');
-  assert.match(band, /once every task linked to it has shipped/, 'explains the precondition instead');
+  assert.doesNotMatch(band, /awaiting UAT:/);
+  assert.match(band, /ready for its UAT once every task linked to it has shipped/);
+});
+
+await test('an older server (no uat_state) keeps the old sentence and draws no UAT control', async () => {
+  const { band } = await render({ criteria: LEGACY });
+  assert.match(band, /1 criterion is met and ready to confirm/);
+  assert.doesNotMatch(band, /data-uat-open|crit-state/, 'no UAT vocabulary the server did not send');
 });
 
 // =========================================================================
@@ -289,47 +363,70 @@ await test('an achieved goal keeps its own summary line', async () => {
 });
 
 // =========================================================================
-// The action itself
+// The action itself — the real wiring, driven by events
 // =========================================================================
 
-await test('clicking Confirm POSTs /done-when/:id/satisfy for that criterion', async () => {
-  const { calls, clickConfirm } = await render();
-  await clickConfirm(CRIT.pending.id);
-  const posts = calls.requests.filter(([m, p]) => m === 'POST' && /\/done-when\/\d+\/satisfy$/.test(p));
-  assert.equal(posts.length, 1, `exactly one satisfy POST — got ${JSON.stringify(calls.requests)}`);
-  assert.match(posts[0][1], new RegExp(`/done-when/${CRIT.pending.id}/satisfy$`), 'targets the clicked criterion');
+await test('opening a criterion reads GET /done-when/:id/uat and draws the panel under its row', async () => {
+  const { calls, openPanel } = await render();
+  const row = await openPanel(CRIT.pending.id);
+  assert.ok(calls.requests.some(([m, p]) => m === 'GET' && /\/done-when\/502\/uat$/.test(p)), 'the UAT view is read');
+  assert.equal(row.children.length, 1, 'one panel appended to the row');
+  assert.match(row.children[0].innerHTML, /data-uat-form="502"/, 'with the sign-off form');
+  assert.match(row.children[0].innerHTML, /I tried this on the live site/, 'and the attestation, since this site cannot read its deploy');
 });
 
-await test('confirming re-reads the goal so the row updates in place (no manual refresh)', async () => {
-  const { calls, clickConfirm } = await render();
+await test('a UAT uploads the recording as raw bytes, THEN signs off naming it, then re-reads the goal', async () => {
+  const { calls, submitForm } = await render();
   const before = calls.requests.filter(([m, p]) => m === 'GET' && /\/goals\/7$/.test(p)).length;
-  await clickConfirm(CRIT.pending.id);
+  const file = { type: 'video/webm', size: 1024 };
+  await submitForm({ file, note: 'made a rank, assigned it', attest: true });
+  assert.equal(calls.fetches.length, 1, 'one upload');
+  assert.match(calls.fetches[0][0], /\/done-when\/502\/uat\/recording$/);
+  assert.equal(calls.fetches[0][1].body, file, 'the file itself is the body, not base64');
+  assert.equal(calls.fetches[0][1].headers['Content-Type'], 'video/webm');
+  const signed = posts(calls, /\/done-when\/502\/uat$/);
+  assert.equal(signed.length, 1);
+  // Compared through JSON: an object born in the vm is never strictly deepEqual.
+  assert.equal(JSON.stringify(signed[0][2]), JSON.stringify({ kind: 'uat', recording: 'uat-502-0123456789abcdef.webm', note: 'made a rank, assigned it', live_attested: true }));
   const after = calls.requests.filter(([m, p]) => m === 'GET' && /\/goals\/7$/.test(p)).length;
-  assert.ok(after > before, 'the detail is force-reloaded after a successful confirm');
+  assert.ok(after > before, 'the detail is force-reloaded so the row closes in place');
+  assert.ok(calls.toasts.some((t) => /criterion is closed/.test(t)));
 });
 
-await test('confirming the LAST criterion announces the goal auto-achieved', async () => {
-  const { calls, clickConfirm } = await render({
-    satisfyResponse: { status: 200, ok: true, data: { criterion: {}, goal_achieved: true, goal: { id: 7, status: 'achieved' } } },
-  });
-  await clickConfirm(CRIT.pending.id);
-  assert.ok(calls.toasts.some((t) => /achieved/i.test(t)), `the auto-achieve is surfaced — got ${JSON.stringify(calls.toasts)}`);
+await test('a backend sign-off sends no recording and requires saying how it was checked', async () => {
+  const empty = await render();
+  const { error } = await empty.submitForm({ note: '   ' });
+  assert.equal(error.textContent, 'Say how you checked it.');
+  assert.equal(posts(empty.calls, /\/uat$/).length, 0, 'nothing is sent without it');
+  const ok = await render();
+  await ok.submitForm({ note: 'the audit log has the row' });
+  assert.equal(JSON.stringify(posts(ok.calls, /\/done-when\/502\/uat$/)[0][2]), JSON.stringify({ kind: 'backend_signoff', note: 'the audit log has the row' }));
+  assert.equal(ok.calls.fetches.length, 0, 'no upload for a backend sign-off');
 });
 
-await test('an ordinary confirm reports success without claiming the goal is achieved', async () => {
-  const { calls, clickConfirm } = await render();
-  await clickConfirm(CRIT.pending.id);
-  assert.ok(calls.toasts.some((t) => /Criterion confirmed\.$/.test(t)), `plain confirmation — got ${JSON.stringify(calls.toasts)}`);
-  assert.ok(!calls.toasts.some((t) => /achieved/i.test(t)), 'no false auto-achieve claim');
+await test('the page refuses before sending: no file, wrong type, over 100 MB, attestation unticked', async () => {
+  const cases = [
+    [{ file: null, attest: true }, 'Choose the recording first.'],
+    [{ file: { type: 'image/png', size: 10 }, attest: true }, 'A UAT recording must be an mp4 or webm video.'],
+    [{ file: { type: 'video/mp4', size: 100 * 1024 * 1024 + 1 }, attest: true }, /over the 100 MB cap/],
+    [{ file: { type: 'video/mp4', size: 10 }, attest: false }, 'Confirm that you tried it on the live site.'],
+  ];
+  for (const [input, expected] of cases) {
+    const r = await render();
+    const { error } = await r.submitForm(input);
+    if (expected instanceof RegExp) assert.match(error.textContent, expected); else assert.equal(error.textContent, expected);
+    assert.equal(r.calls.fetches.length, 0, 'nothing was uploaded');
+    assert.equal(posts(r.calls, /\/uat$/).length, 0, 'nothing was signed');
+  }
 });
 
-await test('a double-click fires the satisfy POST only once', async () => {
-  const { calls, clickConfirm } = await render();
-  const handlersFired = clickConfirm(CRIT.pending.id);
-  await clickConfirm(CRIT.pending.id);
-  await handlersFired;
-  const posts = calls.requests.filter(([m, p]) => m === 'POST' && /\/satisfy$/.test(p));
-  assert.equal(posts.length, 1, `in-flight guard holds — got ${posts.length} POSTs`);
+await test('a server refusal is shown in the server\'s own words, and the goal achieved on the last one is announced', async () => {
+  const refused = await render({ uatPost: { status: 403, ok: false, data: { error: { code: 'signer_shipped_this_work', message: 'You shipped work linked to this criterion, so someone else has to sign it off.' } } } });
+  const { error } = await refused.submitForm({ note: 'checked' });
+  assert.equal(error.textContent, 'You shipped work linked to this criterion, so someone else has to sign it off.');
+  const last = await render({ uatPost: { status: 201, ok: true, data: { ok: true, criterion_closed: true, achieved_goals: [7] } } });
+  await last.submitForm({ note: 'checked' });
+  assert.ok(last.calls.toasts.some((t) => /goal is achieved/.test(t)), JSON.stringify(last.calls.toasts));
 });
 
 summary();

package/tests/goal_map_page.mjs

@@ -427,7 +427,8 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<h1>the sky <em id="lensWord">— the whole project<\/em><\/h1>/, 'the h1 is in static markup, so every state has one');
   assert.equal(/shell\.js|style\.css/.test(html), false, 'no hall chrome yet — /thinking joined it (task 1004327), the project sky did not');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
-  assert.deepEqual(scripts(html).map((s) => s[0]), ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
+  assert.deepEqual(scripts(html).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // /thinking also loads the shell (task 1004327); the SKY's files are the same.
   const skyScripts = (h) => scripts(h).filter((s) => s[0] !== 'shell.js');
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');

package/tests/hall_sky.mjs

@@ -497,4 +497,20 @@ await test('a capped trail is spoken, never a silent slice', async () => {
 });
 
 console.log('');
+await test('a ring carries its UAT state in the goal page words, and says it on hover and in the panel (task 1004402)', async () => {
+  const w = well({ criteria: [
+    { id: '70', criterion_id: 'c1', criterion_md: 'Awaiting ring', satisfied: false, pending_review: true, uat_state: 'awaiting_uat', backend_only: true, task_ids: ['500'] },
+    { id: '71', criterion_id: 'c2', criterion_md: 'Closed ring', satisfied: true, pending_review: false, uat_state: 'closed_before_uat', task_ids: ['500'] },
+    { id: '72', criterion_id: 'c3', criterion_md: 'Open ring', satisfied: false, pending_review: false, uat_state: 'open', task_ids: ['501'] },
+  ] });
+  const p = await boot({ sky: sky([w]) });
+  const crit = p.S().goals[0].crit;
+  assert.equal(crit[0].uatLabel, 'Awaiting UAT');
+  assert.equal(crit[0].backendOnly, true);
+  assert.equal(crit[1].uatLabel, 'Closed before UAT', 'every state, not only awaiting');
+  assert.equal(crit[2].uatLabel, null, 'an open ring needs no word: its open ring already says so');
+  const src = FS.readFileSync('modules/hall-ui/public/sky-interaction.js', 'utf8') + FS.readFileSync('modules/hall-ui/public/sky-panel.js', 'utf8');
+  assert.equal((src.match(/esc\(c\.uatLabel\)/g) || []).length, 2, 'the hover card and the panel both print the label, escaped');
+});
+
 summary();

package/tests/helpers.mjs

@@ -767,7 +767,9 @@ export const settle = () => new Promise((r) => setTimeout(r, 0));
 // carry the same markup and the same scripts and differ in the body's
 // `data-sky-lens` (which lens is home). A test names the `page`; each is parsed
 // from its OWN file, so a button lost from either one fails.
-const SKY_FILES = ['idea-objects.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js'];
+// criterion-uat-ui.js (task 1004402): both sky pages load it before sky-data,
+// which reads the rings' UAT state words from it.
+const SKY_FILES = ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js'];
 const SKY_SRC = SKY_FILES.map((f) => [f, fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', f), 'utf8')]);
 const SKY_PAGES = {};
 function skyPage(page) {

package/tests/projects_hub.mjs

@@ -714,7 +714,9 @@ test('a renumbering of the wizard invalidates old drafts — the key carries the
   assert.match(key, /-v\d+$/, 'the draft key is versioned');
   const panels = (SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1];
   const count = [...panels.matchAll(/\d+:\s*'panel-/g)].length;
-  assert.equal(count, 10, 'gate + eight numbered steps + done — bump DRAFT_KEY when this changes');
+  // task 1004417 put the front door's two screens (terms, fork) in front: the sixth renumbering
+  assert.equal(count, 12, 'gate + the front door\'s two + eight numbered steps + done — bump DRAFT_KEY when this changes');
+  assert.equal(key, 'cb-create-draft-v6', 'and the key moved with the front door');
 });
 
 test('every row lays the same five parts — the ledger has no ragged row', () => {
@@ -2182,7 +2184,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(block, /\.addrBig code\{display:block;font-family:var\(--font-display\);/, 'the address stands in the display voice');
   assert.doesNotMatch(block, /linear-gradient/, 'no tinted plates');
   assert.doesNotMatch(block, /box-shadow:(?!none)/, 'no box shadow in the wizard block');
-  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="7">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
+  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="9">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
   assert.match(HUB, /<h2 class="stepsHead" id="doneStepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style (the id is where a skipped invite step hands focus on, task 1002346)');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');

package/tests/projects_hub_app_status.mjs

@@ -240,7 +240,7 @@ test('a repaint never lands on top of an open Retry — from this watch or a fre
 });
 
 test('both surfaces use it: the done panel and the project page', () => {
-  assert.match(HUB, /if \(box\) watchApp\(instanceId, box, function \(\) \{ return state\.step === 9; \}, 5000\);/);
+  assert.match(HUB, /if \(box\) watchApp\(instanceId, box, function \(\) \{ return state\.step === 11; \}, 5000\);/);
   assert.match(HUB, /<div id="doneApp" hidden><\/div>/);
   assert.match(HUB, /<div class="card mSec" id="mAppCard" hidden>\n\s*<h2>Where its app runs<\/h2>\n\s*<div id="mApp"><\/div>/);
   assert.match(HUB, /loadAppStatus\(inst\.id \|\| asked, inst\);/);

package/tests/projects_hub_app_step.mjs

@@ -142,17 +142,17 @@ test('the panel is real markup: Render and Decide later, Decide later the defaul
   assert.doesNotMatch(PANEL, /Coming soon/, 'and is no longer marked soon');
   assert.match(PANEL, /<input type="radio" name="appPlatform" value="later" checked>/, 'Decide later is the default');
   assert.match(PANEL, /We host your Builders' hall/, 'the step says the hall is ours to host (ADR 0345 D1), in the page\'s one spelling of it');
-  assert.match(PANEL, /<form data-next="8">/, 'Next leads to the review');
-  assert.match(PANEL, /data-back="6"/, 'Back returns to the address step');
+  assert.match(PANEL, /<form data-next="10">/, 'Next leads to the review');
+  assert.match(PANEL, /data-back="8"/, 'Back returns to the address step');
 });
 
 test('the step sits between Address and Review in the panels map and on the rail', () => {
-  assert.match(HUB, /6: 'panel-address', 7: 'panel-app', 8: 'panel-review', 9: 'panel-done'/);
-  assert.match(HUB, /<li data-step="7"><span class="snum">7<\/span><span class="slbl">App<\/span><\/li>/);
-  assert.match(HUB, /<li data-step="8"><span class="snum">8<\/span><span class="slbl">Create<\/span><\/li>/);
-  assert.match(HUB, /data-back="7">← Back<\/button>\n\s*<button type="button" class="btn big" id="doCreate">/, "the review's Back returns to the app step");
-  assert.match(HUB, /if \(step === 7\) \{ syncAppStep\(\); syncRenderSetup\(\); \}\n\s*if \(step === 8\) renderReview\(\);/, 'entering the step repaints it, Render setup included');
-  assert.match(HUB, /if \(step === 7\) return validateRender\(\);/, 'Next on the step runs the Render check');
+  assert.match(HUB, /8: 'panel-address', 9: 'panel-app', 10: 'panel-review', 11: 'panel-done'/);
+  assert.match(HUB, /<li data-step="9"><span class="snum">7<\/span><span class="slbl">App<\/span><\/li>/);
+  assert.match(HUB, /<li data-step="10"><span class="snum">8<\/span><span class="slbl">Create<\/span><\/li>/);
+  assert.match(HUB, /data-back="9">← Back<\/button>\n\s*<button type="button" class="btn big" id="doCreate">/, "the review's Back returns to the app step");
+  assert.match(HUB, /if \(step === 9\) \{ syncAppStep\(\); syncRenderSetup\(\); \}\n\s*if \(step === 10\) renderReview\(\);/, 'entering the step repaints it, Render setup included');
+  assert.match(HUB, /if \(step === 9\) return validateRender\(\);/, 'Next on the step runs the Render check');
 });
 
 test('a fresh draft reads "decide later", and the Render setup stays hidden', () => {
@@ -455,5 +455,5 @@ test('the review names exactly what was chosen, prices included', () => {
 });
 
 test('Create hands the app to Render straight after the project is filed', () => {
-  assert.match(HUB, /show\(9, true\);\n\s*sendRenderSetup\(data\.instance && data\.instance\.id\);/);
+  assert.match(HUB, /show\(11, true\);\n\s*sendRenderSetup\(data\.instance && data\.instance\.id\);/);
 });

package/tests/projects_hub_module_picker.mjs

@@ -41,7 +41,7 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
 
 const START = '/* ── the module picker (task 1002339, BV1.R20) ──';
-const END = "$('skipModules').addEventListener('click', function () { show(5, true); });";
+const END = "$('skipModules').addEventListener('click', function () { show(7, true); });";
 const from = HUB.indexOf(START);
 const to = HUB.indexOf(END);
 assert.ok(from > -1, 'the picker block opens with its sentinel comment');
@@ -160,7 +160,7 @@ function boot({ state: seed = {}, fetchOk = true, payload = PAYLOAD } = {}) {
   const els = new Map();
   const $ = (id) => { if (!els.has(id)) els.set(id, makeEl(id)); return els.get(id); };
   const form = makeEl('panel-modules-form');
-  const state = { step: 4, projType: null, teamShape: null, modules: null, ...seed };
+  const state = { step: 6, projType: null, teamShape: null, modules: null, ...seed };
   const shown = [];
   let saves = 0;
   let fetches = 0;
@@ -312,7 +312,7 @@ test('Skip walks past WITHOUT answering, so the server applies the bundle the pa
 
   // Assert — skipping is the one path that must leave nothing said, because the
   // preselect and the server's fallback are the same declaration (ADR 0237)
-  assert.deepEqual(h.shown, [5], 'it advances to the Home step');
+  assert.deepEqual(h.shown, [7], 'it advances to the Home step (7 since task 1004417)');
   assert.equal(h.state.modules, null, 'and answers nothing');
   assert.equal(h.forCreate(), undefined);
   assert.deepEqual(h.picked(), ['npm-release', 'discord'], 'while the set they were shown is still the set they get');
@@ -377,7 +377,7 @@ test('a catalog that will not load degrades to a clause — it never blocks a pr
   assert.match(h.coreNote(), /couldn’t load/, 'the panel says so in the owner\'s words');
   assert.equal(h.state.modules, null, 'nothing is answered on their behalf');
   h.skip();
-  assert.deepEqual(h.shown, [5], 'and the wizard still walks on — the server applies the bundle');
+  assert.deepEqual(h.shown, [7], 'and the wizard still walks on — the server applies the bundle');
 });
 
 test('every rendered value goes through the page escaper', async () => {
@@ -415,7 +415,7 @@ test('the review names the set even when the picker was never opened (task 10023
   // and the module NAMES are not known. "None — just the core" would be a false
   // promise on the last screen before Create: the server is about to apply the
   // type's bundle. The row says that instead, then repaints when the read lands.
-  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
+  const h = boot({ state: { projType: 'game', step: 10 } });   // 10 = the review since task 1004417 (8 since 1004351)
 
   // Arrange + Act — the review asks for the value before the read can answer
   const first = h.extrasRow();
@@ -510,7 +510,7 @@ test('Skip after an answered About step still yields the set the panel showed',
 
   h.skip();
 
-  assert.deepEqual(h.shown, [5]);
+  assert.deepEqual(h.shown, [7]);
   assert.equal(h.state.modules, null, 'skipping answers nothing, tailored or not');
   assert.equal(h.forCreate(), undefined, 'so the create request still carries no modules key');
   assert.deepEqual(h.picked(), ['discord'], 'while the set they were shown is still the set they get');
@@ -821,7 +821,7 @@ test('with nothing switched on the count says only what is shown', async () => {
 });
 
 test('the review names the hidden picks too — a filter never reaches the create request', async () => {
-  const h = boot({ state: { projType: 'game', step: 8 } });   // 8 = the review since task 1004351
+  const h = boot({ state: { projType: 'game', step: 10 } });   // 10 = the review since task 1004417 (8 since 1004351)
   await h.open();
   h.click('agents');
   assert.deepEqual(h.forCreate(), ['agents', 'npm-release', 'discord']);

package/tests/projects_hub_pre_uat.mjs

@@ -550,7 +550,10 @@ test('the rail at the done panel keeps its marker on Create until the project an
   assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
   assert.ok(SCRIPT.includes(`if (state.step === ${DONE}) paintRail(${DONE});`),
     'the done-panel poll repaints when the status moves');
-  assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
+  // the first NUMBERED beat carries it — since task 1004417 the front door's two screens come
+  // before the rail, and the card statically wears wizFront so a no-script visitor sees no rail there
+  assert.match(HUB, new RegExp(`<li class="now" data-step="${STEP['panel-name']}" aria-current="step"><span class="snum">1</span>`), 'the static rail starts with the same marker');
+  assert.match(HUB, /<section id="view-new" hidden>\s*<div class="wrap viewWrap">\s*<div class="card wizFront">/, 'and steps aside on the static first screen');
 });
 
 test('every action result announces, nothing under the pointer is deleted, and focus stays where it was', () => {