@bongos/core 1.20.58 → 1.20.60

package/src/branding.js

@@ -19,6 +19,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { resolveCoreRoot, resolveInstanceRoot, resolveEnv, FALLBACK_ENV_PREFIX } = require('./instance-config');
+const { applyLook, readLibraryLook } = require('./hall-look');
 
 // ADR 0108 §1: the neutral starter ships WITH the core package; the instance
 // pack is host content. Both resolvers return the repo root today, so this is
@@ -83,6 +84,16 @@ const ENV_OVERRIDES = [
   // door is `open` and this is `none`. Like its neighbours it is memoized for the
   // process, which is why the platform restarts the instance to apply a change.
   ['SPEND_PAYER', ['project', 'spendPayer']],
+  // The look this hall wears (ADR 0358, task 1004421) — own | a style-library name |
+  // custom — and its night tint (on | off). Policy keys like their neighbours: the
+  // platform pushes them and a restart applies them. LOOK_ACCENT (a custom look's one
+  // accent, already made readable by the platform) and LOGO_URL (the platform's
+  // content-addressed logo) are their companions. src/hall-look.js turns them into
+  // the fifteen; an unknown or malformed value leaves the hall on its own pack.
+  ['LOOK', ['project', 'look']],
+  ['NIGHT_TINT', ['project', 'nightTint']],
+  ['LOOK_ACCENT', ['project', 'lookAccent']],
+  ['LOGO_URL', ['project', 'logoUrl']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
@@ -115,7 +126,7 @@ function deepFreeze(o) {
 // resolver. Decided in ADR 0142 (audit H11 / task 1002224).
 //
 // Pure resolver — all inputs injected, so tests drive it with zero I/O.
-function resolveBranding({ neutral = {}, instance = {}, env = {} } = {}) {
+function resolveBranding({ neutral = {}, instance = {}, env = {}, readLook = readLibraryLook } = {}) {
   // structuredClone so the merged result shares no nested references with the
   // neutral/instance inputs — otherwise the deepFreeze below would also freeze
   // the caller's input objects (deepMerge shallow-copies only the top level).
@@ -142,6 +153,9 @@ function resolveBranding({ neutral = {}, instance = {}, env = {} } = {}) {
   if (missing.length) {
     throw new Error(`branding: missing required field(s): ${missing.map((p) => p.join('.')).join(', ')}`);
   }
+  // The chosen look, laid over the pack's theme (ADR 0358). A no-op for a hall that
+  // chose none, which is every hall the platform has not pushed a look to.
+  applyLook(resolved, readLook);
   return deepFreeze(resolved);
 }
 
@@ -240,6 +254,11 @@ function clientBranding(b = branding()) {
       },
       favicon: ui.favicon || '',
       backdrop: ui.backdrop || '',
+      // The look (ADR 0358): which one this hall wears ('' = its own pack), whether
+      // its night is tinted (only ever true with a look), and its logo address.
+      look: ui.look || '',
+      nightTint: ui.nightTint === true,
+      logo: ui.logo || '',
     },
     copy: {
       tagline: b.copy?.tagline || '',
@@ -282,6 +301,12 @@ function clientBranding(b = branding()) {
       // with?", not the platform's record of what they saved. The fallback is the
       // platform default, which for this key IS today's behaviour.
       spendPayer: b.project?.spendPayer || 'none',
+      // The look and its night (ADR 0358, task 1004421). Published for the read-back
+      // reason its neighbours are: the settings push compares this manifest with what
+      // the platform saved. The fallbacks are the platform defaults — 'own' is today's
+      // hall, and 'on' only ever tints a hall that wears a look.
+      look: b.project?.look || 'own',
+      nightTint: b.project?.nightTint || 'on',
     },
   };
 }

package/src/hall-look.js

@@ -0,0 +1,99 @@
+// src/hall-look.js — the look a hall wears, laid over its branding pack (ADR 0358,
+// task 1004421).
+//
+// The platform chooses a project's look (provisioning settings `look`, `night_tint`
+// plus the companion LOOK_ACCENT and LOGO_URL) and pushes only NAMES over web.env;
+// src/branding.js maps them onto project.look / nightTint / lookAccent / logoUrl and
+// hands the merged pack here. This file turns the name into the fifteen, reading the
+// style library the core package ships (a module's styles/<name>/pack.json, ADR 0219),
+// so a palette never travels as env text. The library is found by its SHAPE — any
+// shipped module's styles/ directory — never by a module key, which core may not name
+// (ADR 0083 §Decision #4).
+//
+//   own (or absent)  the instance's own pack — exactly today's hall.
+//   <library name>   that look's thirteen colours and two faces.
+//   custom           the chrome world with ONE accent, already made readable in both
+//                    modes by the platform (lookAdjustAccent); a value that is not a
+//                    plain #rrggbb is ignored and the hall stays on its own pack.
+//
+// Favicon and backdrop stay the instance's (ADR 0219 §1) except that a looked hall
+// gets a favicon in its own colours, and a logo, when there is one, is the favicon.
+// PURE given `readLook`; the default reader is the only I/O.
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const HEX = /^#[0-9a-f]{6}$/i;
+const LOOK_NAME = /^[a-z][a-z-]{0,39}$/;
+// A logo address is the platform's content-addressed image URL. https only, and no
+// character that could end the attribute or the CSS it is written into.
+const LOGO_URL = /^https:\/\/[^\s"'<>()\\]+$/;
+
+// The style library's packs, read once each. null for an unknown name or a pack that
+// does not carry the thirteen as hex — a broken file never half-applies.
+const _looks = new Map();
+function readLibraryLook(name, { root } = {}) {
+  if (!LOOK_NAME.test(String(name || ''))) return null;
+  const key = `${root || ''}|${name}`;
+  if (_looks.has(key)) return _looks.get(key);
+  let ui = null;
+  try {
+    const base = root || require('./instance-config').resolveCoreRoot(); // eslint-disable-line global-require
+    const modulesDir = path.join(base, 'modules');
+    const file = fs.readdirSync(modulesDir).sort()
+      .map((m) => path.join(modulesDir, m, 'styles', name, 'pack.json'))
+      .find((f) => fs.existsSync(f));
+    const pack = file ? JSON.parse(fs.readFileSync(file, 'utf8')) : null;
+    const t = pack && pack.theme && pack.theme.ui;
+    if (t && t.colors && Object.values(t.colors).every((v) => HEX.test(v)) && t.fonts) ui = { colors: t.colors, fonts: t.fonts };
+  } catch { ui = null; }
+  _looks.set(key, ui);
+  return ui;
+}
+
+// The favicon a looked hall shows without a logo: the chrome world's two-circle mark
+// redrawn in the look's own accent, terracotta and card.
+function lookFavicon(colors) {
+  const c = (k) => encodeURIComponent(colors[k]);
+  return "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'>" +
+    `<circle cx='12' cy='17' r='8' fill='${c('accent')}'/><circle cx='22' cy='17' r='6' fill='${c('terracotta')}'/>` +
+    `<circle cx='12' cy='17' r='3.5' fill='${c('bgCard')}'/><circle cx='22' cy='17' r='2.5' fill='${c('bgCard')}'/></svg>`;
+}
+
+// What the hall wears: { name, ui } or null for its own pack. PURE given readLook.
+function chosenLook(project = {}, readLook = readLibraryLook) {
+  const name = String(project.look || 'own');
+  if (name === 'own') return null;
+  if (name === 'custom') {
+    const accent = String(project.lookAccent || '');
+    const base = HEX.test(accent) ? readLook('chrome-world') : null;
+    return base ? { name, ui: { colors: { ...base.colors, accent: accent.toLowerCase() }, fonts: base.fonts } } : null;
+  }
+  const ui = readLook(name);
+  return ui ? { name, ui } : null;
+}
+
+// Lay the look over a resolved (still mutable) pack, in place. A logo applies with or
+// without a look; the night tint only with one (ADR 0358 D2), so a hall that never
+// chose a look renders exactly as before whatever its tint setting says.
+function applyLook(resolved, readLook = readLibraryLook) {
+  const project = resolved.project || {};
+  const look = chosenLook(project, readLook);
+  const logo = LOGO_URL.test(String(project.logoUrl || '')) ? project.logoUrl : '';
+  if (!look && !logo) return resolved;
+  resolved.theme = resolved.theme && typeof resolved.theme === 'object' ? resolved.theme : {};
+  const ui = { ...(resolved.theme.ui || {}) };
+  if (look) {
+    ui.colors = { ...look.ui.colors };
+    ui.fonts = { ...look.ui.fonts };
+    ui.look = look.name;
+    ui.nightTint = project.nightTint !== 'off';
+    ui.favicon = lookFavicon(ui.colors);
+  }
+  if (logo) { ui.logo = logo; ui.favicon = logo; }
+  resolved.theme.ui = ui;
+  return resolved;
+}
+
+module.exports = { applyLook, readLibraryLook };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.58'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.60'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/night-tint.js

@@ -0,0 +1,26 @@
+// src/night-tint.js — the night tint a hall wears with a look (ADR 0358, task 1004421).
+//
+// The hall's dark tier (modules/hall-ui/public/style.css) is pure black. A hall that
+// wears a look takes a hint of that look's own accent into its four dark grounds
+// instead, so two halls stay told apart at night too. It is a FORMULA over the
+// thirteen, never a palette a look authors: no token is added, and a custom accent
+// gets its own night for free. This table is the one copy — themeMarkup() emits it
+// and tests/hall_tokens.mjs (UI_DESIGN_TINT=1) measures it.
+'use strict';
+
+const NIGHT_TINT = Object.freeze({
+  '--bg': 'color-mix(in srgb, var(--accent) 6%, #000000)',
+  '--bg-deep': 'color-mix(in srgb, var(--accent) 6%, #000000)',
+  '--bg-frame': 'color-mix(in srgb, var(--accent) 6%, #08080a)',
+  '--bg-card': 'color-mix(in srgb, var(--accent) 5%, #101012)',
+});
+
+// The CSS that applies it: the same two dark twins the sheet writes (the [data-theme]
+// switch shell.js owns, and the media block that covers first paint), at the same
+// specificity. Injected AFTER the sheet, so later wins. PURE.
+function nightTintCss() {
+  const decls = Object.entries(NIGHT_TINT).map(([k, v]) => `${k}:${v};`).join('');
+  return `html[data-theme="dark"]{${decls}}@media (prefers-color-scheme: dark){html:not([data-theme]){${decls}}}`;
+}
+
+module.exports = { NIGHT_TINT, nightTintCss };

package/tests/copy_desk_page_reads.mjs

@@ -35,7 +35,7 @@ api.pool = {
   async query(sql, params = []) {
     const q = flat(sql);
     seen.push({ q, params });
-    if (/FROM tasks t LEFT JOIN task_grades g/.test(q)) {
+    if (/FROM pt JOIN tasks t ON t\.id = pt\.id LEFT JOIN task_grades g/.test(q)) {
       assert.match(q, /WHERE t\.source = 'page-tweak'/);
       // The fixture rows stand in for this SELECT, so every column they carry
       // must be one the SELECT really names: a renamed alias would otherwise

package/tests/currency_label.mjs

@@ -59,11 +59,14 @@ test('clientBranding exposes project policy — the settings read-back (task 100
   // is published for a reason of its own: it is the one key that can REFUSE a
   // module, so an owner looking at a module that will not turn on needs the
   // instance's own answer rather than the platform's record of what they saved.
+  // `look` and `nightTint` joined in task 1004421 (ADR 0358) — the look the hall wears
+  // and whether its night takes a tint. Public because the hall paints them in the
+  // browser; their fallbacks ('own', 'on') are what an unconfigured hall shows today.
   assert.deepEqual(clientBranding({}).project,
-    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' });
+    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none', look: 'own', nightTint: 'on' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder', look: 'grove', nightTint: 'off' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder', look: 'grove', nightTint: 'off' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -86,7 +89,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // public for the same read-back reason as its neighbours. Its companion stamp
   // (artistGateSince) deliberately does NOT: that is platform bookkeeping the server
   // reads, and no browser surface has a question it answers.
-  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'platformVisibility', 'spendPayer', 'visibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'look', 'nightTint', 'platformVisibility', 'spendPayer', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/fixtures/page-ledger.mjs

@@ -188,7 +188,7 @@ export function installPageLedger(api, { builders }) {
       return { rows: db.tasks.filter((t) => t.status === 'shipped' && Date.parse(t.shipped_at) > since && (t.touches || []).some((f) => p[0].includes(f))).map((t) => ({ id: t.id, title: t.title, shipped_at: t.shipped_at })) };
     }
     // The page reads (listPageTweakTasks), computed from the ledger's state.
-    if (/FROM tasks t LEFT JOIN task_grades g/.test(q)) {
+    if (/FROM pt JOIN tasks t ON t\.id = pt\.id LEFT JOIN task_grades g/.test(q)) {
       assert.match(q, /WHERE t\.source = 'page-tweak'/);
       // The optional page scope (task 1004319): $1 is the round-ref prefix or null.
       assert.match(q, /left\(t\.source_ref, length\(\$1::text\)\) = \$1::text/);

package/tests/hall_tokens.mjs

@@ -41,6 +41,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -102,9 +103,17 @@ const PACK = Object.fromEntries(
   Object.entries(packUi.colors).map(([k, v]) => [camelToVar(k), v]),
 );
 
+// UI_DESIGN_TINT=1 measures the NIGHT TINT a hall wears with a look (ADR 0358, task
+// 1004421): themeMarkup() lays src/night-tint.js's four grounds over the dark tier,
+// after the sheet, so they win. tests/look_night_tint.mjs runs this file once per look
+// with it set, and once per custom accent round the hue wheel.
+const NIGHT_TINT = process.env.UI_DESIGN_TINT === '1'
+  ? createRequire(import.meta.url)('../src/night-tint.js').NIGHT_TINT
+  : {};
+
 const RAW = {
   light: { ...contractTier, ...PACK },
-  dark: { ...contractTier, ...PACK, ...darkExplicit },
+  dark: { ...contractTier, ...PACK, ...darkExplicit, ...NIGHT_TINT },
 };
 
 // ── color resolution ─────────────────────────────────────────────────────────

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-09-30-navback2/);
+    assert.match(HTML, /shell\.js\?v=2026-10-01-look/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/look_night_tint.mjs

@@ -0,0 +1,169 @@
+// tests/look_night_tint.mjs — the look a hall wears, its night tint and its logo, hall
+// side (task 1004421, BV2.PS06; ADR 0358).
+//
+// The load-bearing assertions:
+//   • THE BLEND RULE: a hall that never chose a look is exactly today's hall — the
+//     same theme, the same markup, pure black at night — whatever its tint setting;
+//   • a pushed look name becomes that look's fifteen on the instance, read from the
+//     style library the core ships; an unknown name or a malformed accent leaves the
+//     hall on its own pack rather than half-applying;
+//   • the night tint is emitted only with a look, as both dark twins, after the sheet;
+//   • CONTRAST: the hall's own token suite (tests/hall_tokens.mjs) passes under every
+//     library look with the tint on, and under custom accents round the hue wheel
+//     after the platform's nudge — light, dark and tinted dark;
+//   • a logo address reaches the hall mark and the favicon only when it is a plain
+//     https URL.
+//
+// Run:  node --test tests/look_night_tint.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { resolveBranding, clientBranding } = require('../src/branding.js');
+const { themeMarkup } = require('../src/bongos/serve-internal.js');
+const { NIGHT_TINT, nightTintCss } = require('../src/night-tint.js');
+const { lookAdjustAccent, LIBRARY_LOOKS } = require('../modules/provisioning/look.js');
+
+const neutral = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'branding.neutral.json'), 'utf8'));
+const brand = (env = {}) => clientBranding(resolveBranding({ neutral, env }));
+const packOf = (name) => JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'styles', name, 'pack.json'), 'utf8')).theme.ui;
+
+test('the blend rule: no look means today\'s hall, whatever the tint setting says', () => {
+  const today = brand();
+  for (const env of [{ BONGOS_LOOK: 'own' }, { BONGOS_NIGHT_TINT: 'on' }, { BONGOS_LOOK: 'own', BONGOS_NIGHT_TINT: 'on' }]) {
+    const b = brand(env);
+    assert.deepEqual(b.theme, today.theme, JSON.stringify(env));
+    assert.equal(themeMarkup(b.theme), themeMarkup(today.theme));
+  }
+  assert.equal(today.theme.nightTint, false);
+  assert.equal(today.theme.look, '');
+  assert.ok(!themeMarkup(today.theme).includes('data-theme'), 'no dark block is injected for a hall without a look');
+  assert.deepEqual(today.theme.colors, neutral.theme.ui.colors);
+});
+
+test('a library look becomes its fifteen, and the manifest reads back what was pushed', () => {
+  for (const name of LIBRARY_LOOKS) {
+    const b = brand({ BONGOS_LOOK: name });
+    const ui = packOf(name);
+    assert.deepEqual(b.theme.colors, ui.colors, name);
+    assert.deepEqual(b.theme.fonts, { display: ui.fonts.display, body: ui.fonts.body, links: ui.fonts.links }, name);
+    assert.equal(b.theme.look, name);
+    assert.equal(b.project.look, name, 'the settings read-back (settingsConsumed) sees the pushed name');
+    assert.equal(b.theme.nightTint, true, 'the tint is on by default with a look');
+    assert.match(b.theme.favicon, new RegExp(encodeURIComponent(ui.colors.accent)), 'the tab icon is drawn in the look\'s accent');
+  }
+  assert.equal(brand({ BONGOS_LOOK: 'grove', BONGOS_NIGHT_TINT: 'off' }).theme.nightTint, false, 'the founder can switch back to pure black');
+  assert.equal(brand({ BONGOS_LOOK: 'grove', BONGOS_NIGHT_TINT: 'off' }).project.nightTint, 'off');
+});
+
+test('a custom look is the chrome world with one accent; an unusable accent or an unknown look leaves the hall alone', () => {
+  const b = brand({ BONGOS_LOOK: 'custom', BONGOS_LOOK_ACCENT: '#B48CF2' });
+  assert.deepEqual(b.theme.colors, { ...packOf('chrome-world').colors, accent: '#b48cf2' });
+  assert.equal(b.theme.look, 'custom');
+  const today = brand();
+  for (const env of [{ BONGOS_LOOK: 'custom' }, { BONGOS_LOOK: 'custom', BONGOS_LOOK_ACCENT: 'red;}body{x' }, { BONGOS_LOOK: 'neon' }, { BONGOS_LOOK: '../../etc' }]) {
+    assert.deepEqual(brand(env).theme, today.theme, JSON.stringify(env));
+  }
+});
+
+test('the night tint is emitted with a look, as both dark twins, and nowhere else', () => {
+  const on = themeMarkup(brand({ BONGOS_LOOK: 'expedition' }).theme);
+  assert.ok(on.includes(nightTintCss()), 'the tint block is in the markup');
+  assert.ok(on.indexOf(':root{') < on.indexOf(nightTintCss()), 'after the palette, so the dark grounds win on order');
+  assert.equal(nightTintCss().split('--bg:').length - 1, 2, 'written twice: the [data-theme] switch and the media twin');
+  assert.match(nightTintCss(), /html\[data-theme="dark"\]\{/);
+  assert.match(nightTintCss(), /@media \(prefers-color-scheme: dark\)\{html:not\(\[data-theme\]\)\{/);
+  for (const v of Object.values(NIGHT_TINT)) assert.match(v, /^color-mix\(in srgb, var\(--accent\) \d+%, #[0-9a-f]{6}\)$/, 'derived from the look\'s own accent, never a literal colour');
+  assert.ok(!themeMarkup(brand({ BONGOS_LOOK: 'expedition', BONGOS_NIGHT_TINT: 'off' }).theme).includes('data-theme'));
+});
+
+test('a logo reaches the hall only as a plain https address, and becomes its favicon', () => {
+  const url = 'https://platform.test/api/bongos/provisioning/logos/' + 'a'.repeat(64) + '.png';
+  const b = brand({ BONGOS_LOGO_URL: url });
+  assert.equal(b.theme.logo, url);
+  assert.equal(b.theme.favicon, url);
+  assert.equal(b.theme.nightTint, false, 'a logo alone tints nothing');
+  assert.deepEqual(b.theme.colors, neutral.theme.ui.colors, 'a logo alone changes no colour');
+  for (const bad of ['http://x.test/a.png', 'javascript:alert(1)', 'https://x.test/a.png"><script>', 'https://x.test/a b.png', 'https://x.test/a.png)']) {
+    assert.equal(brand({ BONGOS_LOGO_URL: bad }).theme.logo, '', bad);
+  }
+  const shell = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'shell.js'), 'utf8');
+  assert.match(shell, /brand\.theme && brand\.theme\.logo\s*\?\s*'<img class="brand-mark__logo" src="' \+ esc\(brand\.theme\.logo\)/, 'the hall mark shows the logo, escaped, in the dot\'s place');
+  assert.match(fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'style.css'), 'utf8'), /\.brand-mark__logo \{/);
+});
+
+// ── contrast: the hall's own suite, under each look, with the tint on ──────────────
+const childEnv = (extra) => {
+  const env = { ...process.env, ...extra };
+  delete env.NODE_TEST_CONTEXT; // a nested node --test must run its own tests, not report to ours
+  return env;
+};
+function hallSuite(extra) {
+  const r = spawnSync(process.execPath, ['--test', '--test-reporter=tap', 'tests/hall_tokens.mjs'], {
+    cwd: ROOT, encoding: 'utf8', env: childEnv({ UI_DESIGN_TINT: '1', ...extra }), timeout: 120000,
+  });
+  const fails = (r.stdout || '').split('\n').filter((l) => /= \d+\.\d+:1/.test(l)).map((l) => l.trim());
+  return { status: r.status, fails };
+}
+
+test('the hall clears AA under every library look with the night tint on', () => {
+  for (const name of LIBRARY_LOOKS) {
+    const r = hallSuite({ UI_DESIGN_PACK: path.join(ROOT, 'modules', 'ui-design', 'styles', name, 'pack.json') });
+    assert.equal(r.status, 0, `${name}, tinted night:\n${r.fails.join('\n')}`);
+  }
+});
+
+test('the hall clears AA under custom accents round the hue wheel, once the platform has nudged them', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'look-tint-'));
+  const chrome = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'styles', 'chrome-world', 'pack.json'), 'utf8'));
+  const hsl = (h, s, l) => {
+    const a = s * Math.min(l, 1 - l), k = (n) => (n + h / 30) % 12;
+    const f = (n) => Math.round(255 * (l - a * Math.max(-1, Math.min(k(n) - 3, 9 - k(n), 1))));
+    return '#' + [f(0), f(8), f(4)].map((x) => x.toString(16).padStart(2, '0')).join('');
+  };
+  // Saturated hues at three lightnesses, plus the greys — the corners of the space.
+  const raw = [];
+  for (let h = 0; h < 360; h += 45) for (const l of [0.25, 0.5, 0.8]) raw.push(hsl(h, 1, l));
+  raw.push('#000000', '#808080', '#ffffff');
+  const failures = [];
+  try {
+    for (const hex of raw) {
+      const kept = lookAdjustAccent(hex).hex;
+      const pack = structuredClone(chrome);
+      pack.theme.ui.colors.accent = kept;
+      const file = path.join(tmp, `${hex.slice(1)}.json`);
+      fs.writeFileSync(file, JSON.stringify(pack));
+      for (const tint of ['0', '1']) {
+        const r = hallSuite({ UI_DESIGN_PACK: file, UI_DESIGN_TINT: tint });
+        if (r.status !== 0) failures.push(`${hex} → ${kept} (${tint === '1' ? 'tinted' : 'black'} night): ${r.fails.join('; ') || 'suite failed'}`);
+      }
+    }
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+  assert.deepEqual(failures, []);
+});
+
+test('UI_DESIGN_TINT is honoured, not decorative: a tint that is too strong fails the hall suite', () => {
+  // Proves the knob reaches the resolver: the same suite, with the card tinted far past
+  // the shipped share, must go red on the pair the 8% draft already failed.
+  const src = fs.readFileSync(path.join(ROOT, 'tests', 'hall_tokens.mjs'), 'utf8');
+  assert.match(src, /process\.env\.UI_DESIGN_TINT === '1'/);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'look-tint-strong-'));
+  try {
+    const strong = path.join(tmp, 'night-tint.js');
+    fs.writeFileSync(strong, fs.readFileSync(path.join(ROOT, 'src', 'night-tint.js'), 'utf8').replace(/var\(--accent\) 5%, #101012/, 'var(--accent) 30%, #101012'));
+    const probe = path.join(tmp, 'hall_tokens.mjs');
+    fs.writeFileSync(probe, src.replace("'../src/night-tint.js'", JSON.stringify(strong)).replace(
+      "path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')", JSON.stringify(ROOT)));
+    const r = spawnSync(process.execPath, ['--test', '--test-reporter=tap', probe], { cwd: ROOT, encoding: 'utf8', env: childEnv({ UI_DESIGN_TINT: '1' }), timeout: 120000 });
+    assert.notEqual(r.status, 0, 'a 30% card tint must fail the hall suite');
+    assert.match(r.stdout, /dark --[\w-]+ on --[\w-]+ = \d/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});

package/tests/main_discipline.mjs

@@ -0,0 +1,81 @@
+// tests/main_discipline.mjs — the builder's own MAIN role (task 1004433 /
+// WA6.RP03, core_268): what updateBuilderDisciplines sends for each of the
+// three answers, and what it refuses before anything is written.
+//
+// The statement's own behaviour (keep, clear, set) runs against a real Postgres
+// in tests/role_stats_db.mjs; this pins the half before it, DB-free: the
+// "named or not" flag, the value, and the refusal of a main role that is not
+// one of the builder's chosen crafts.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+const calls = [];
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: {
+    pool: {
+      async query(sql, params) {
+        calls.push({ sql, params });
+        return { rows: [{ id: params[0], preferred_disciplines: params[1], main_discipline: params[2] ? params[3] : null }] };
+      },
+    },
+  },
+};
+const db = require('../src/bongos/db.js');
+const { enabledDisciplines } = require('../src/modules.js');
+const offered = enabledDisciplines();
+const last = () => calls[calls.length - 1];
+
+await t('the write goes through the one exported statement', async () => {
+  await db.updateBuilderDisciplines(7, ['engineer']);
+  assert.equal(last().sql, db.UPDATE_BUILDER_DISCIPLINES_SQL);
+  assert.match(db.UPDATE_BUILDER_DISCIPLINES_SQL, /main_discipline = CASE WHEN \$3::boolean THEN \$4::text/);
+  assert.match(db.UPDATE_BUILDER_DISCIPLINES_SQL, /WHEN main_discipline = ANY\(\$2::text\[\]\) THEN main_discipline\s+ELSE NULL END/);
+});
+
+await t('not mentioned: the flag is false, so the stored main role is left to the statement to keep or clear', async () => {
+  await db.updateBuilderDisciplines(7, ['engineer', 'ideator']);
+  assert.deepEqual(last().params.slice(2), [false, null]);
+});
+
+await t('named: the flag is true and the role travels', async () => {
+  await db.updateBuilderDisciplines(7, ['ideator', 'engineer'], { mainDiscipline: 'ideator' });
+  assert.deepEqual(last().params.slice(2), [true, 'ideator']);
+  assert.deepEqual(last().params[1], offered.filter((d) => ['ideator', 'engineer'].includes(d)),
+    'the set is still stored in canonical order: the main role is what carries the choice');
+});
+
+await t('null clears it on purpose', async () => {
+  await db.updateBuilderDisciplines(7, ['engineer'], { mainDiscipline: null });
+  assert.deepEqual(last().params.slice(2), [true, null]);
+});
+
+await t('a main role that is not one of the chosen crafts is refused, and nothing is written', async () => {
+  const before = calls.length;
+  await assert.rejects(() => db.updateBuilderDisciplines(7, ['engineer'], { mainDiscipline: 'ideator' }),
+    (err) => err.code === 'invalid_main_discipline' && err.bad[0] === 'ideator');
+  assert.equal(calls.length, before);
+});
+
+await t('the PATCH route hands main_discipline through only when the body names it', async () => {
+  const fs = require('node:fs');
+  const src = fs.readFileSync(require.resolve('../src/bongos/routes/me.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.patch('/me/disciplines'"), src.indexOf("router.patch('/me/disciplines'") + 2500);
+  assert.match(route, /hasOwnProperty\.call\(body, 'main_discipline'\)/);
+  assert.match(route, /db\.updateBuilderDisciplines\(req\.builder\.id, input, mainOpt\)/);
+  assert.match(route, /invalid_main_discipline/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'c05e9d87594aca3c';
+const SHELL_SHA = '51a13ea563542113';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);