@bongos/core 1.20.59 → 1.20.61

package/tests/autonomy_runner_identity.mjs

@@ -0,0 +1,215 @@
+// tests/autonomy_runner_identity.mjs — the runner card says which PC, which Claude
+// account, which code, and whether the runner is live or restarting (task 1004407).
+//
+// Owner ruling, 2026-10-01: showing the code version is good, and showing when it
+// is restarting versus live is better, along with which always-on PC and which
+// Claude account it runs on. These pin each of those from the runner that reports
+// them, through the route and the SQL, to the verdict the hall renders. The rule
+// that holds across all of it: an unknown is shown as nothing, never as a guess,
+// and a secret is never what gets sent.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_runner_identity.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const health = req(path.join(ROOT, 'modules/autonomy/runner-health.js'));
+const runner = req(path.join(ROOT, 'scripts/gds/autobongos-run.js'));
+
+const NOW = Date.parse('2026-10-01T12:00:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const A = 'a'.repeat(40);
+const B = 'b'.repeat(40);
+const hb = (over = {}) => ({ host: 'gmk-always-on', mode: 'full', last_event: 'loop', last_seen_at: agoS(30), ...over });
+
+// ── live or restarting ───────────────────────────────────────────────────────────
+
+test('a runner that just exited to pick up new code reads RESTARTING, not dead', () => {
+  const d = health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(90) }), { nowMs: NOW });
+  assert.equal(d.state, 'restarting');
+  assert.equal(d.ok, true, 'a restart is not a fault');
+  assert.match(d.detail, /restarting on gmk-always-on to pick up new code/);
+});
+
+test('a restart that never came back is dead, and says it was a restart', () => {
+  const d = health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S + 60) }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+  assert.equal(d.ok, false);
+  assert.match(d.detail, /exited on gmk-always-on .* to restart on new code and has not come back/);
+});
+
+test('the restart window ends exactly at RESTART_S', () => {
+  assert.equal(health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S) }), { nowMs: NOW }).state, 'restarting');
+  assert.equal(health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S + 1) }), { nowMs: NOW }).state, 'dead');
+});
+
+test('a live runner says what it last did, in words', () => {
+  assert.match(health.describeRunner(hb({ last_event: 'code_refreshed' }), { nowMs: NOW }).detail, /updated its code in place on gmk-always-on/);
+  assert.match(health.describeRunner(hb({ last_event: 'waiting' }), { nowMs: NOW }).detail, /waiting for work/);
+  assert.match(health.describeRunner(hb({ last_event: 'loop' }), { nowMs: NOW }).detail, /^running on/, 'an event with no words keeps the old wording');
+  assert.match(health.describeRunner(hb({ working_task_id: '4242', last_event: 'worked' }), { nowMs: NOW }).detail, /working task 4242/);
+});
+
+// ── which code ───────────────────────────────────────────────────────────────────
+
+test('the code version is shown short, and flagged when it is behind main', () => {
+  const d = health.describeRunner(hb({ head: A, main_head: B }), { nowMs: NOW });
+  assert.equal(d.code.short, 'aaaaaaaa');
+  assert.equal(d.code.behind, true);
+  assert.equal(d.code.mainShort, 'bbbbbbbb');
+  assert.equal(health.describeRunner(hb({ head: A, main_head: A }), { nowMs: NOW }).code.behind, false);
+});
+
+test('an unknown main is never drawn as "out of date"', () => {
+  const c = health.describeRunner(hb({ head: A }), { nowMs: NOW }).code;
+  assert.equal(c.behind, null);
+  assert.equal(c.mainShort, null);
+});
+
+test('a checkout refreshed in place is current by what is on DISK', () => {
+  // Workers and child processes run what is on disk (task 1004406), so a
+  // refreshed runner whose own process is older is still up to date.
+  const c = health.describeRunner(hb({ head: A, disk_head: B, main_head: B }), { nowMs: NOW }).code;
+  assert.equal(c.behind, false);
+  assert.equal(c.diskShort, 'bbbbbbbb');
+});
+
+test('no head, or a head that is not a commit, shows no code line at all', () => {
+  for (const head of [null, undefined, '', 'abc', 'Z'.repeat(40), A.toUpperCase()]) {
+    assert.equal(health.describeRunner(hb({ head }), { nowMs: NOW }).code, null, String(head));
+  }
+});
+
+// ── which PC and which account ───────────────────────────────────────────────────
+
+test('the PC and the Claude account ride on every state, dead included', () => {
+  for (const [over, state] of [[{}, 'alive'], [{ last_seen_at: agoS(health.LATE_S + 1) }, 'dead'], [{ last_event: 'upgrade_exit' }, 'restarting']]) {
+    const d = health.describeRunner(hb({ claude_account: 'me@example.com', head: A, ...over }), { nowMs: NOW });
+    assert.equal(d.state, state);
+    assert.equal(d.host, 'gmk-always-on');
+    assert.equal(d.account, 'me@example.com', `${state} must still say whose account it spent`);
+    assert.ok(d.code, `${state} must still say which code`);
+  }
+});
+
+test('the account label names a key or a token by its variable, never its value', () => {
+  const secret = 'sk-ant-SECRET-VALUE';
+  const viaKey = runner.claudeAccountLabel({ env: { ANTHROPIC_API_KEY: secret }, readFile: () => { throw new Error('unread'); } });
+  assert.equal(viaKey, 'an API key (ANTHROPIC_API_KEY)');
+  const viaToken = runner.claudeAccountLabel({ env: { CLAUDE_CODE_OAUTH_TOKEN: secret }, readFile: () => { throw new Error('unread'); } });
+  assert.equal(viaToken, 'a Claude token (CLAUDE_CODE_OAUTH_TOKEN)');
+  assert.ok(!viaKey.includes(secret) && !viaToken.includes(secret));
+});
+
+test('otherwise the label is the login Claude Code records, with its organisation', () => {
+  const seen = [];
+  const file = (o) => (p) => { seen.push(p); return JSON.stringify({ oauthAccount: o, primaryApiKey: 'never-read' }); };
+  assert.equal(runner.claudeAccountLabel({ env: { CLAUDE_CONFIG_DIR: '/cfg' }, readFile: file({ emailAddress: 'me@example.com', organizationName: 'Acme' }) }), 'me@example.com · Acme');
+  assert.equal(path.normalize(seen[0]), path.normalize('/cfg/.claude.json'), 'CLAUDE_CONFIG_DIR is where Claude Code keeps it when set');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: file({ emailAddress: 'me@example.com' }) }), 'me@example.com');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: file({}) }), null, 'no login reads as unknown');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: () => 'not json' }), null);
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: () => { throw new Error('ENOENT'); } }), null);
+});
+
+// ── the runner sends it ──────────────────────────────────────────────────────────
+
+test('every server check-in carries the code and the account, and the newest main seen', async () => {
+  const bodies = [];
+  const api = { autonomy: { postAutonomyHeartbeat: async ({ body }) => { bodies.push(body); return { ok: true }; } } };
+  const state = runner.newRunnerState();
+  // codeDrifted is what learns main's tip; it must keep it for the heartbeat.
+  await runner.codeDrifted({ loadedHead: async () => A, run: async () => ({ ok: true, stdout: `${B}\trefs/heads/main\n` }), state });
+  assert.equal(state.mainHead, B);
+  await runner.loadedHead({ run: async () => ({ ok: true, stdout: `${A}\n` }) });
+  await runner.postHeartbeat({ last_event: 'loop' }, { api, state, claudeAccountLabel: () => 'me@example.com' });
+  assert.equal(bodies[0].head, A);
+  assert.equal(bodies[0].main_head, B);
+  assert.equal(bodies[0].claude_account, 'me@example.com');
+  assert.equal(bodies[0].last_event, 'loop');
+  assert.equal('disk_head' in bodies[0], false, 'no refresh in place, so no disk_head');
+
+  state.diskHead = B;
+  await runner.postHeartbeat({}, { api, state, claudeAccountLabel: () => null });
+  assert.equal(bodies[1].disk_head, B);
+  assert.equal('claude_account' in bodies[1], false, 'an unknown account is left out, not sent empty');
+});
+
+// ── the route and the SQL ────────────────────────────────────────────────────────
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = (r, _s, next) => { r.builder = { id: 3, rank: 'archon' }; next(); };
+  api.requirePermission = () => (_r, _s, next) => next();
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try { return req(routePath)(); } finally { api.requireBuilder = saved.b; api.requirePermission = saved.p; }
+}
+
+test('the route stores a commit only if it is one, and the account label as sent', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.recordRunnerHeartbeat;
+  const seen = [];
+  db.recordRunnerHeartbeat = async (a) => { seen.push(a); return {}; };
+  const app = express(); app.use(express.json()); app.use(attachFail); app.use(autonomyRouter());
+  const server = app.listen(0); await new Promise((r) => server.once('listening', r));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/autonomy/heartbeat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+  try {
+    let r = await post({ host: 'gmk-always-on', head: A, disk_head: B, main_head: B, claude_account: '  me@example.com  ' });
+    assert.equal(r.status, 200);
+    assert.deepEqual([seen[0].head, seen[0].diskHead, seen[0].mainHead, seen[0].claudeAccount], [A, B, B, 'me@example.com']);
+    r = await post({ host: 'gmk-always-on', head: 'not-a-commit', main_head: A.toUpperCase(), claude_account: '' });
+    assert.equal(r.status, 200, 'a bad version never costs the runner its check-in');
+    assert.deepEqual([seen[1].head, seen[1].mainHead, seen[1].claudeAccount], [null, null, null]);
+    r = await post({ host: 'gmk-always-on', claude_account: 'x'.repeat(201) });
+    assert.equal(r.status, 400, 'the label is capped, so a key pasted into it by mistake is refused, not stored');
+  } finally {
+    server.close();
+    db.recordRunnerHeartbeat = saved;
+  }
+});
+
+test('the heartbeat SQL overwrites the identity every beat and reads it back', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ head: A }] }; };
+  try {
+    await db.recordRunnerHeartbeat({ builderId: 3, host: 'gmk-always-on', head: A, diskHead: B, mainHead: B, claudeAccount: 'me@example.com' });
+    for (const col of ['head', 'disk_head', 'main_head', 'claude_account']) {
+      assert.match(calls[0].sql, new RegExp(`\\b${col} = EXCLUDED\\.${col}\\b`), `${col} is overwritten, never kept from the last process`);
+    }
+    assert.deepEqual(calls[0].params.slice(9), [A, B, B, 'me@example.com']);
+    await db.readRunnerHeartbeats(3);
+    assert.match(calls[1].sql, /head, disk_head, main_head, claude_account/);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the migration adds the four columns, additively', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/autonomy/migrations/autonomy_004_runner_identity.sql'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  for (const col of ['head', 'disk_head', 'main_head', 'claude_account']) {
+    assert.match(sql, new RegExp(`ADD COLUMN IF NOT EXISTS ${col} text`));
+  }
+  assert.doesNotMatch(sql, /\bDROP\b/i);
+});
+
+test('the gate card draws the PC, the account, the code and the restarting label', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(src, /restarting: 'Restarting'/);
+  assert.match(src, /PC <strong>\$\{escapeHtml\(h\.host\)\}<\/strong>/);
+  assert.match(src, /Claude account \$\{escapeHtml\(h\.account\)\}/);
+  assert.match(src, /behind main/);
+});

package/tests/currency_label.mjs

@@ -59,11 +59,14 @@ test('clientBranding exposes project policy — the settings read-back (task 100
   // is published for a reason of its own: it is the one key that can REFUSE a
   // module, so an owner looking at a module that will not turn on needs the
   // instance's own answer rather than the platform's record of what they saved.
+  // `look` and `nightTint` joined in task 1004421 (ADR 0358) — the look the hall wears
+  // and whether its night takes a tint. Public because the hall paints them in the
+  // browser; their fallbacks ('own', 'on') are what an unconfigured hall shows today.
   assert.deepEqual(clientBranding({}).project,
-    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' });
+    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none', look: 'own', nightTint: 'on' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder', look: 'grove', nightTint: 'off' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder', look: 'grove', nightTint: 'off' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -86,7 +89,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // public for the same read-back reason as its neighbours. Its companion stamp
   // (artistGateSince) deliberately does NOT: that is platform bookkeeping the server
   // reads, and no browser surface has a question it answers.
-  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'platformVisibility', 'spendPayer', 'visibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'look', 'nightTint', 'platformVisibility', 'spendPayer', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/hall_tokens.mjs

@@ -41,6 +41,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -102,9 +103,17 @@ const PACK = Object.fromEntries(
   Object.entries(packUi.colors).map(([k, v]) => [camelToVar(k), v]),
 );
 
+// UI_DESIGN_TINT=1 measures the NIGHT TINT a hall wears with a look (ADR 0358, task
+// 1004421): themeMarkup() lays src/night-tint.js's four grounds over the dark tier,
+// after the sheet, so they win. tests/look_night_tint.mjs runs this file once per look
+// with it set, and once per custom accent round the hue wheel.
+const NIGHT_TINT = process.env.UI_DESIGN_TINT === '1'
+  ? createRequire(import.meta.url)('../src/night-tint.js').NIGHT_TINT
+  : {};
+
 const RAW = {
   light: { ...contractTier, ...PACK },
-  dark: { ...contractTier, ...PACK, ...darkExplicit },
+  dark: { ...contractTier, ...PACK, ...darkExplicit, ...NIGHT_TINT },
 };
 
 // ── color resolution ─────────────────────────────────────────────────────────

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-09-30-navback2/);
+    assert.match(HTML, /shell\.js\?v=2026-10-01-look/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/look_night_tint.mjs

@@ -0,0 +1,169 @@
+// tests/look_night_tint.mjs — the look a hall wears, its night tint and its logo, hall
+// side (task 1004421, BV2.PS06; ADR 0358).
+//
+// The load-bearing assertions:
+//   • THE BLEND RULE: a hall that never chose a look is exactly today's hall — the
+//     same theme, the same markup, pure black at night — whatever its tint setting;
+//   • a pushed look name becomes that look's fifteen on the instance, read from the
+//     style library the core ships; an unknown name or a malformed accent leaves the
+//     hall on its own pack rather than half-applying;
+//   • the night tint is emitted only with a look, as both dark twins, after the sheet;
+//   • CONTRAST: the hall's own token suite (tests/hall_tokens.mjs) passes under every
+//     library look with the tint on, and under custom accents round the hue wheel
+//     after the platform's nudge — light, dark and tinted dark;
+//   • a logo address reaches the hall mark and the favicon only when it is a plain
+//     https URL.
+//
+// Run:  node --test tests/look_night_tint.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { resolveBranding, clientBranding } = require('../src/branding.js');
+const { themeMarkup } = require('../src/bongos/serve-internal.js');
+const { NIGHT_TINT, nightTintCss } = require('../src/night-tint.js');
+const { lookAdjustAccent, LIBRARY_LOOKS } = require('../modules/provisioning/look.js');
+
+const neutral = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'branding.neutral.json'), 'utf8'));
+const brand = (env = {}) => clientBranding(resolveBranding({ neutral, env }));
+const packOf = (name) => JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'styles', name, 'pack.json'), 'utf8')).theme.ui;
+
+test('the blend rule: no look means today\'s hall, whatever the tint setting says', () => {
+  const today = brand();
+  for (const env of [{ BONGOS_LOOK: 'own' }, { BONGOS_NIGHT_TINT: 'on' }, { BONGOS_LOOK: 'own', BONGOS_NIGHT_TINT: 'on' }]) {
+    const b = brand(env);
+    assert.deepEqual(b.theme, today.theme, JSON.stringify(env));
+    assert.equal(themeMarkup(b.theme), themeMarkup(today.theme));
+  }
+  assert.equal(today.theme.nightTint, false);
+  assert.equal(today.theme.look, '');
+  assert.ok(!themeMarkup(today.theme).includes('data-theme'), 'no dark block is injected for a hall without a look');
+  assert.deepEqual(today.theme.colors, neutral.theme.ui.colors);
+});
+
+test('a library look becomes its fifteen, and the manifest reads back what was pushed', () => {
+  for (const name of LIBRARY_LOOKS) {
+    const b = brand({ BONGOS_LOOK: name });
+    const ui = packOf(name);
+    assert.deepEqual(b.theme.colors, ui.colors, name);
+    assert.deepEqual(b.theme.fonts, { display: ui.fonts.display, body: ui.fonts.body, links: ui.fonts.links }, name);
+    assert.equal(b.theme.look, name);
+    assert.equal(b.project.look, name, 'the settings read-back (settingsConsumed) sees the pushed name');
+    assert.equal(b.theme.nightTint, true, 'the tint is on by default with a look');
+    assert.match(b.theme.favicon, new RegExp(encodeURIComponent(ui.colors.accent)), 'the tab icon is drawn in the look\'s accent');
+  }
+  assert.equal(brand({ BONGOS_LOOK: 'grove', BONGOS_NIGHT_TINT: 'off' }).theme.nightTint, false, 'the founder can switch back to pure black');
+  assert.equal(brand({ BONGOS_LOOK: 'grove', BONGOS_NIGHT_TINT: 'off' }).project.nightTint, 'off');
+});
+
+test('a custom look is the chrome world with one accent; an unusable accent or an unknown look leaves the hall alone', () => {
+  const b = brand({ BONGOS_LOOK: 'custom', BONGOS_LOOK_ACCENT: '#B48CF2' });
+  assert.deepEqual(b.theme.colors, { ...packOf('chrome-world').colors, accent: '#b48cf2' });
+  assert.equal(b.theme.look, 'custom');
+  const today = brand();
+  for (const env of [{ BONGOS_LOOK: 'custom' }, { BONGOS_LOOK: 'custom', BONGOS_LOOK_ACCENT: 'red;}body{x' }, { BONGOS_LOOK: 'neon' }, { BONGOS_LOOK: '../../etc' }]) {
+    assert.deepEqual(brand(env).theme, today.theme, JSON.stringify(env));
+  }
+});
+
+test('the night tint is emitted with a look, as both dark twins, and nowhere else', () => {
+  const on = themeMarkup(brand({ BONGOS_LOOK: 'expedition' }).theme);
+  assert.ok(on.includes(nightTintCss()), 'the tint block is in the markup');
+  assert.ok(on.indexOf(':root{') < on.indexOf(nightTintCss()), 'after the palette, so the dark grounds win on order');
+  assert.equal(nightTintCss().split('--bg:').length - 1, 2, 'written twice: the [data-theme] switch and the media twin');
+  assert.match(nightTintCss(), /html\[data-theme="dark"\]\{/);
+  assert.match(nightTintCss(), /@media \(prefers-color-scheme: dark\)\{html:not\(\[data-theme\]\)\{/);
+  for (const v of Object.values(NIGHT_TINT)) assert.match(v, /^color-mix\(in srgb, var\(--accent\) \d+%, #[0-9a-f]{6}\)$/, 'derived from the look\'s own accent, never a literal colour');
+  assert.ok(!themeMarkup(brand({ BONGOS_LOOK: 'expedition', BONGOS_NIGHT_TINT: 'off' }).theme).includes('data-theme'));
+});
+
+test('a logo reaches the hall only as a plain https address, and becomes its favicon', () => {
+  const url = 'https://platform.test/api/bongos/provisioning/logos/' + 'a'.repeat(64) + '.png';
+  const b = brand({ BONGOS_LOGO_URL: url });
+  assert.equal(b.theme.logo, url);
+  assert.equal(b.theme.favicon, url);
+  assert.equal(b.theme.nightTint, false, 'a logo alone tints nothing');
+  assert.deepEqual(b.theme.colors, neutral.theme.ui.colors, 'a logo alone changes no colour');
+  for (const bad of ['http://x.test/a.png', 'javascript:alert(1)', 'https://x.test/a.png"><script>', 'https://x.test/a b.png', 'https://x.test/a.png)']) {
+    assert.equal(brand({ BONGOS_LOGO_URL: bad }).theme.logo, '', bad);
+  }
+  const shell = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'shell.js'), 'utf8');
+  assert.match(shell, /brand\.theme && brand\.theme\.logo\s*\?\s*'<img class="brand-mark__logo" src="' \+ esc\(brand\.theme\.logo\)/, 'the hall mark shows the logo, escaped, in the dot\'s place');
+  assert.match(fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'style.css'), 'utf8'), /\.brand-mark__logo \{/);
+});
+
+// ── contrast: the hall's own suite, under each look, with the tint on ──────────────
+const childEnv = (extra) => {
+  const env = { ...process.env, ...extra };
+  delete env.NODE_TEST_CONTEXT; // a nested node --test must run its own tests, not report to ours
+  return env;
+};
+function hallSuite(extra) {
+  const r = spawnSync(process.execPath, ['--test', '--test-reporter=tap', 'tests/hall_tokens.mjs'], {
+    cwd: ROOT, encoding: 'utf8', env: childEnv({ UI_DESIGN_TINT: '1', ...extra }), timeout: 120000,
+  });
+  const fails = (r.stdout || '').split('\n').filter((l) => /= \d+\.\d+:1/.test(l)).map((l) => l.trim());
+  return { status: r.status, fails };
+}
+
+test('the hall clears AA under every library look with the night tint on', () => {
+  for (const name of LIBRARY_LOOKS) {
+    const r = hallSuite({ UI_DESIGN_PACK: path.join(ROOT, 'modules', 'ui-design', 'styles', name, 'pack.json') });
+    assert.equal(r.status, 0, `${name}, tinted night:\n${r.fails.join('\n')}`);
+  }
+});
+
+test('the hall clears AA under custom accents round the hue wheel, once the platform has nudged them', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'look-tint-'));
+  const chrome = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'styles', 'chrome-world', 'pack.json'), 'utf8'));
+  const hsl = (h, s, l) => {
+    const a = s * Math.min(l, 1 - l), k = (n) => (n + h / 30) % 12;
+    const f = (n) => Math.round(255 * (l - a * Math.max(-1, Math.min(k(n) - 3, 9 - k(n), 1))));
+    return '#' + [f(0), f(8), f(4)].map((x) => x.toString(16).padStart(2, '0')).join('');
+  };
+  // Saturated hues at three lightnesses, plus the greys — the corners of the space.
+  const raw = [];
+  for (let h = 0; h < 360; h += 45) for (const l of [0.25, 0.5, 0.8]) raw.push(hsl(h, 1, l));
+  raw.push('#000000', '#808080', '#ffffff');
+  const failures = [];
+  try {
+    for (const hex of raw) {
+      const kept = lookAdjustAccent(hex).hex;
+      const pack = structuredClone(chrome);
+      pack.theme.ui.colors.accent = kept;
+      const file = path.join(tmp, `${hex.slice(1)}.json`);
+      fs.writeFileSync(file, JSON.stringify(pack));
+      for (const tint of ['0', '1']) {
+        const r = hallSuite({ UI_DESIGN_PACK: file, UI_DESIGN_TINT: tint });
+        if (r.status !== 0) failures.push(`${hex} → ${kept} (${tint === '1' ? 'tinted' : 'black'} night): ${r.fails.join('; ') || 'suite failed'}`);
+      }
+    }
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+  assert.deepEqual(failures, []);
+});
+
+test('UI_DESIGN_TINT is honoured, not decorative: a tint that is too strong fails the hall suite', () => {
+  // Proves the knob reaches the resolver: the same suite, with the card tinted far past
+  // the shipped share, must go red on the pair the 8% draft already failed.
+  const src = fs.readFileSync(path.join(ROOT, 'tests', 'hall_tokens.mjs'), 'utf8');
+  assert.match(src, /process\.env\.UI_DESIGN_TINT === '1'/);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'look-tint-strong-'));
+  try {
+    const strong = path.join(tmp, 'night-tint.js');
+    fs.writeFileSync(strong, fs.readFileSync(path.join(ROOT, 'src', 'night-tint.js'), 'utf8').replace(/var\(--accent\) 5%, #101012/, 'var(--accent) 30%, #101012'));
+    const probe = path.join(tmp, 'hall_tokens.mjs');
+    fs.writeFileSync(probe, src.replace("'../src/night-tint.js'", JSON.stringify(strong)).replace(
+      "path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')", JSON.stringify(ROOT)));
+    const r = spawnSync(process.execPath, ['--test', '--test-reporter=tap', probe], { cwd: ROOT, encoding: 'utf8', env: childEnv({ UI_DESIGN_TINT: '1' }), timeout: 120000 });
+    assert.notEqual(r.status, 0, 'a 30% card tint must fail the hall suite');
+    assert.match(r.stdout, /dark --[\w-]+ on --[\w-]+ = \d/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'c05e9d87594aca3c';
+const SHELL_SHA = '51a13ea563542113';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/projects_hub.mjs

@@ -715,8 +715,9 @@ test('a renumbering of the wizard invalidates old drafts — the key carries the
   const panels = (SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1];
   const count = [...panels.matchAll(/\d+:\s*'panel-/g)].length;
   // task 1004417 put the front door's two screens (terms, fork) in front: the sixth renumbering
-  assert.equal(count, 12, 'gate + the front door\'s two + eight numbered steps + done — bump DRAFT_KEY when this changes');
-  assert.equal(key, 'cb-create-draft-v6', 'and the key moved with the front door');
+  // task 1004421 put the Look step between App and Review: the seventh
+  assert.equal(count, 13, 'gate + the front door\'s two + nine numbered steps + done — bump DRAFT_KEY when this changes');
+  assert.equal(key, 'cb-create-draft-v7', 'and the key moved with the Look step');
 });
 
 test('every row lays the same five parts — the ledger has no ragged row', () => {
@@ -2137,7 +2138,7 @@ test('the wizard takes the world by scope: no card ground, the six-step strip as
   assert.match(block, /#view-new \.card\{background:none;border-radius:0;box-shadow:none;/, 'no card ground');
   // eight tracks since task 1004351 added the App step (seven since 1002339); the count is the
   // rail's own, so it moves with the panels map rather than being a magic number
-  assert.match(block, /#view-new \.steps\{display:grid;grid-template-columns:repeat\(8,1fr\);/, 'the strip lays a track per numbered step');
+  assert.match(block, /#view-new \.steps\{display:grid;grid-template-columns:repeat\(9,1fr\);/, 'the strip lays a track per numbered step');
   assert.match(block, /#view-new \.steps li::before\{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;/, 'the connector becomes the 7px dot');
   assert.match(block, /#view-new \.steps li\.now::before\{background:var\(--accent\);border-color:var\(--accent\);outline:4px solid/, 'the lit step carries the accent and an outline halo');
   assert.match(block, /#view-new \.panel h1\{font-weight:300;[^}]*text-transform:lowercase;/, 'the step title in the display voice, lowercase');
@@ -2184,7 +2185,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(block, /\.addrBig code\{display:block;font-family:var\(--font-display\);/, 'the address stands in the display voice');
   assert.doesNotMatch(block, /linear-gradient/, 'no tinted plates');
   assert.doesNotMatch(block, /box-shadow:(?!none)/, 'no box shadow in the wizard block');
-  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="9">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
+  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="10">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
   assert.match(HUB, /<h2 class="stepsHead" id="doneStepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style (the id is where a skipped invite step hands focus on, task 1002346)');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');

package/tests/projects_hub_app_status.mjs

@@ -240,7 +240,7 @@ test('a repaint never lands on top of an open Retry — from this watch or a fre
 });
 
 test('both surfaces use it: the done panel and the project page', () => {
-  assert.match(HUB, /if \(box\) watchApp\(instanceId, box, function \(\) \{ return state\.step === 11; \}, 5000\);/);
+  assert.match(HUB, /if \(box\) watchApp\(instanceId, box, function \(\) \{ return state\.step === 12; \}, 5000\);/);
   assert.match(HUB, /<div id="doneApp" hidden><\/div>/);
   assert.match(HUB, /<div class="card mSec" id="mAppCard" hidden>\n\s*<h2>Where its app runs<\/h2>\n\s*<div id="mApp"><\/div>/);
   assert.match(HUB, /loadAppStatus\(inst\.id \|\| asked, inst\);/);

package/tests/projects_hub_app_step.mjs

@@ -142,16 +142,17 @@ test('the panel is real markup: Render and Decide later, Decide later the defaul
   assert.doesNotMatch(PANEL, /Coming soon/, 'and is no longer marked soon');
   assert.match(PANEL, /<input type="radio" name="appPlatform" value="later" checked>/, 'Decide later is the default');
   assert.match(PANEL, /We host your Builders' hall/, 'the step says the hall is ours to host (ADR 0345 D1), in the page\'s one spelling of it');
-  assert.match(PANEL, /<form data-next="10">/, 'Next leads to the review');
+  assert.match(PANEL, /<form data-next="10">/, 'Next leads to the Look step (task 1004421), then the review');
   assert.match(PANEL, /data-back="8"/, 'Back returns to the address step');
 });
 
-test('the step sits between Address and Review in the panels map and on the rail', () => {
-  assert.match(HUB, /8: 'panel-address', 9: 'panel-app', 10: 'panel-review', 11: 'panel-done'/);
+test('the step sits between Address and the Look step in the panels map and on the rail', () => {
+  assert.match(HUB, /8: 'panel-address', 9: 'panel-app', 10: 'panel-look', 11: 'panel-review', 12: 'panel-done'/);
   assert.match(HUB, /<li data-step="9"><span class="snum">7<\/span><span class="slbl">App<\/span><\/li>/);
-  assert.match(HUB, /<li data-step="10"><span class="snum">8<\/span><span class="slbl">Create<\/span><\/li>/);
-  assert.match(HUB, /data-back="9">← Back<\/button>\n\s*<button type="button" class="btn big" id="doCreate">/, "the review's Back returns to the app step");
-  assert.match(HUB, /if \(step === 9\) \{ syncAppStep\(\); syncRenderSetup\(\); \}\n\s*if \(step === 10\) renderReview\(\);/, 'entering the step repaints it, Render setup included');
+  assert.match(HUB, /<li data-step="10"><span class="snum">8<\/span><span class="slbl">Look<\/span><\/li>/);
+  assert.match(HUB, /<li data-step="11"><span class="snum">9<\/span><span class="slbl">Create<\/span><\/li>/);
+  assert.match(HUB, /data-back="10">← Back<\/button>\n\s*<button type="button" class="btn big" id="doCreate">/, "the review's Back returns to the Look step");
+  assert.match(HUB, /if \(step === 9\) \{ syncAppStep\(\); syncRenderSetup\(\); \}\n\s*if \(step === 10\) renderLook\(\);\n\s*if \(step === 11\) renderReview\(\);/, 'entering the step repaints it, Render setup included');
   assert.match(HUB, /if \(step === 9\) return validateRender\(\);/, 'Next on the step runs the Render check');
 });
 
@@ -455,5 +456,5 @@ test('the review names exactly what was chosen, prices included', () => {
 });
 
 test('Create hands the app to Render straight after the project is filed', () => {
-  assert.match(HUB, /show\(11, true\);\n\s*sendRenderSetup\(data\.instance && data\.instance\.id\);/);
+  assert.match(HUB, /show\(12, true\);\n\s*sendRenderSetup\(data\.instance && data\.instance\.id\);/);
 });