@bongos/core 1.21.108 → 1.21.110

package/tests/craft_review_mode.mjs

@@ -0,0 +1,307 @@
+// tests/craft_review_mode.mjs — artist review mode (task 1004686, goal 1000095).
+//
+// Owner ask, 2026-10-09: hovering the Review button in Artistry opens a menu of
+// the four experiences (Ideator, Governing, Building, Artistry); picking one
+// puts the artist into review mode on that mode's view, and graffiti is painted
+// across the top bar's empty space while it lasts. These cases run the REAL
+// craft-mode.js (and, when it is loaded, the real craft-review.js) over a small
+// DOM, and read the real craft-review.css for the motion rules.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const CRAFT = read('craft-mode.js');
+const REVIEW = read('craft-review.js');
+const CSS = read('craft-review.css');
+const STYLE = read('style.css');
+
+function node(tag, id, cls) {
+  const attrs = {};
+  const listeners = {};
+  const classes = new Set(String(cls || '').split(/\s+/).filter(Boolean));
+  const el = {
+    tagName: tag, id: id || '', dataset: {}, children: [], parentNode: null, innerHTML: '', title: '', type: '', src: '', textContent: '',
+    get className() { return [...classes].join(' '); }, set className(v) { classes.clear(); String(v).split(/\s+/).filter(Boolean).forEach((c) => classes.add(c)); },
+    classList: {
+      add: (c) => classes.add(c), remove: (c) => classes.delete(c), contains: (c) => classes.has(c),
+      toggle: (c, on) => { if (on === undefined) on = !classes.has(c); if (on) classes.add(c); else classes.delete(c); return on; },
+    },
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    get nextSibling() { const s = this.parentNode && this.parentNode.children; return s ? s[s.indexOf(this) + 1] || null : null; },
+    appendChild(c) { c.parentNode = this; this.children.push(c); if (this.onAppend) this.onAppend(c); return c; },
+    insertBefore(c, ref) { c.parentNode = this; const at = ref ? this.children.indexOf(ref) : -1; if (at === -1) this.children.push(c); else this.children.splice(at, 0, c); return c; },
+    removeChild(c) { this.children.splice(this.children.indexOf(c), 1); c.parentNode = null; return c; },
+    contains(n) { for (let x = n; x; x = x.parentNode) if (x === el) return true; return false; },
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    fire(t, ev = {}) { (listeners[t] || []).forEach((fn) => fn({ target: el, preventDefault() {}, ...ev })); },
+    click(ev) { el.fire('click', ev); },
+    focus() {},
+  };
+  return el;
+}
+function all(root) { return root.children.flatMap((c) => [c, ...all(c)]); }
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+// One page load. Pass the same `session` to a second boot and it is a reload.
+function boot({ session = {}, store = {}, narrow = false } = {}) {
+  const sidebar = node('NAV', 'app-sidebar');
+  const topbar = node('DIV', 'app-topbar');
+  const title = topbar.appendChild(node('H2', 'topbar-title'));
+  const side = topbar.appendChild(node('DIV', '', 'topbar-side'));
+  const sw = side.appendChild(node('DIV', 'craft-switch'));
+  const head = node('HEAD');
+  const root = node('HTML');
+  const loaded = [];
+  const opened = [];
+  const docListeners = {};
+  const everything = () => [sidebar, topbar, ...all(sidebar), ...all(topbar)];
+  const document = {
+    documentElement: root, body: node('BODY'), head, activeElement: null,
+    currentScript: { src: 'https://h/builders/craft-mode.js?v=2026-10-09-test' },
+    getElementById: (id) => everything().find((n) => n.id === id) || null,
+    querySelector: (sel) => (sel === '#app-topbar > .topbar-side' ? side : null),
+    querySelectorAll: (sel) => (sel === '[data-craft-tool]' ? everything().filter((n) => n.hasAttribute('data-craft-tool')) : []),
+    createElement: (t) => node(t.toUpperCase()),
+    addEventListener(t, fn) { (docListeners[t] ||= new Set()).add(fn); },
+    removeEventListener(t, fn) { if (docListeners[t]) docListeners[t].delete(fn); },
+    dispatchEvent() { return true; },
+  };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const window = { localStorage: mk(store), sessionStorage: mk(session), matchMedia: (q) => ({ matches: narrow && /max-width: 640px/.test(q) }), location: { search: '' } };
+  const sandbox = { window, document, Promise, setTimeout, clearTimeout, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  vm.createContext(sandbox);
+  // "Loading" a script: the wall runs the REAL craft-review.js; the palette is a fake panel.
+  head.onAppend = (tag) => {
+    loaded.push(tag.src);
+    if (/craft-review\.js/.test(tag.src)) vm.runInContext(REVIEW, sandbox, { filename: 'craft-review.js' });
+    else window.OTBPageNotes = { open: () => opened.push('open'), openNote: () => {} };
+    tag.onload();
+  };
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  side.innerHTML = window.OTBCraftMode.switchHtml();
+  window.OTBCraftMode.mount();
+  const byId = (id) => document.getElementById(id);
+  return {
+    craft: window.OTBCraftMode, root, topbar, side, sw, title, loaded, opened, session, byId, docListeners,
+    tools: () => all(side).filter((n) => n.hasAttribute('data-craft-tool')).map((n) => n.id.replace('craft-tool-', '')),
+    menu: () => byId('craft-review-menu'),
+    menuOpen: () => !!byId('craft-review-menu') && !byId('craft-review-menu').hasAttribute('hidden'),
+    // A click on a menu item: the menu's own listener reads the button off the target.
+    pick: (attrs) => byId('craft-review-menu').fire('click', { target: { closest: () => ({ getAttribute: (k) => (k in attrs ? attrs[k] : null) }) } }),
+  };
+}
+const artist = () => ({ 'hall-craft': 'artistry', 'hall-craft-asked': '1' });
+
+test('THE SPLIT PILL: in Artistry, Review rides a group with a review-mode chevron and a closed menu', () => {
+  const p = boot({ session: artist() });
+  const pill = p.byId('craft-review');
+  assert.ok(pill, 'the group exists');
+  assert.equal(p.byId('craft-tool-palette').parentNode, pill, 'Review sits in it');
+  const more = p.byId('craft-review-more');
+  assert.equal(more.parentNode, pill);
+  assert.equal(more.getAttribute('aria-haspopup'), 'menu');
+  assert.equal(more.getAttribute('aria-expanded'), 'false');
+  assert.equal(more.getAttribute('aria-controls'), 'craft-review-menu');
+  assert.equal(p.menu().getAttribute('role'), 'menu');
+  assert.ok(p.menu().hasAttribute('hidden'), 'the menu starts closed');
+  assert.equal(p.byId('craft-graffiti'), null, 'no wall until a review starts');
+  assert.equal(p.root.getAttribute('data-craft-review'), null);
+  for (const m of ['building', 'ideating', 'governing']) {
+    p.craft.choose(m);
+    assert.equal(p.byId('craft-review'), null, `no Review pill in ${m}`);
+  }
+});
+
+test('THE MENU: write feedback first, then the four experiences in the owner\'s order and words', () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.ok(p.menuOpen(), 'the chevron opens it');
+  assert.equal(p.byId('craft-review-more').getAttribute('aria-expanded'), 'true');
+  const html = p.menu().innerHTML;
+  const labels = [...html.matchAll(/<span>([^<]+)<\/span>/g)].map((m) => m[1]);
+  assert.deepEqual(labels, ['Write feedback on this page', 'Ideator experience', 'Governing experience', 'Building experience', 'Artistry experience']);
+  assert.deepEqual([...html.matchAll(/data-review-pick="([a-z]+)"/g)].map((m) => m[1]), ['ideating', 'governing', 'building', 'artistry']);
+  assert.equal((html.match(/role="menuitemradio" aria-checked="true"/g) || []).length, 0, 'nothing is checked before a review');
+  assert.doesNotMatch(html, /Stop reviewing/, 'no way out of a review that has not started');
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.ok(!p.menuOpen(), 'the chevron closes it again');
+});
+
+test('HOVER opens it for a mouse, never for a touch, and leaving closes it after a beat', async () => {
+  const p = boot({ session: artist() });
+  const pill = p.byId('craft-review');
+  pill.fire('pointerenter', { pointerType: 'touch' });
+  assert.ok(!p.menuOpen(), 'a touch is not a hover');
+  pill.fire('pointerenter', { pointerType: 'mouse' });
+  assert.ok(p.menuOpen(), 'a mouse over the pill opens the menu');
+  pill.fire('pointerleave', { pointerType: 'mouse' });
+  assert.ok(p.menuOpen(), 'it stays a beat, so the pointer can reach the menu');
+  pill.fire('pointerenter', { pointerType: 'mouse' });
+  await new Promise((r) => setTimeout(r, 260));
+  assert.ok(p.menuOpen(), 'coming back in cancels the close');
+  pill.fire('pointerleave', { pointerType: 'mouse' });
+  await new Promise((r) => setTimeout(r, 260));
+  assert.ok(!p.menuOpen(), 'and leaving for good closes it');
+});
+
+test('CLICKING Review still opens the feedback panel; on a phone a tap opens the menu instead', async () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-tool-palette').click({ detail: 1 });
+  await flush();
+  assert.deepEqual(p.opened, ['open'], 'the feedback doc opens, as before');
+  assert.ok(!p.menuOpen());
+  const phone = boot({ session: artist(), narrow: true });
+  phone.byId('craft-tool-palette').click({ detail: 1 });
+  await flush();
+  assert.deepEqual(phone.opened, [], 'no panel on the tap');
+  assert.ok(phone.menuOpen(), 'the menu instead (a phone has no hover)');
+  phone.pick({ 'data-review-act': 'write' });
+  await flush();
+  assert.deepEqual(phone.opened, ['open'], 'and its first line opens the feedback doc');
+});
+
+test('PICKING an experience: the hall wears that mode, the artist keeps the Review tools, and the wall goes up', async () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  p.pick({ 'data-review-pick': 'governing' });
+  assert.ok(!p.menuOpen(), 'the menu closes on a pick');
+  assert.equal(p.root.dataset.craft, 'governing', 'the hall wears Governing: its tabs, look and tallies follow');
+  assert.equal(p.root.getAttribute('data-craft-review'), 'governing');
+  assert.equal(p.craft.current(), 'governing');
+  assert.equal(p.craft.reviewing(), 'governing');
+  assert.equal(p.session['hall-craft'], 'artistry', 'the artist\'s own mode stays Artistry');
+  assert.equal(p.session['hall-craft-review'], 'governing', 'the review lasts the session');
+  assert.deepEqual(p.tools(), ['palette', 'paintbrush'], 'Review and Edit words stay in the bar');
+  assert.ok(p.byId('craft-tool-palette').classList.contains('craft-tool--reviewing'));
+  const wall = p.byId('craft-graffiti');
+  assert.ok(wall, 'the graffiti wall is up');
+  assert.equal(wall.parentNode, p.topbar, 'in the top bar');
+  assert.equal(wall.nextSibling, p.side, 'in the empty space before the controls');
+  assert.equal(wall.getAttribute('aria-hidden'), 'true', 'decorative');
+  await flush();
+  assert.deepEqual(p.loaded, ['/builders/craft-review.js?v=2026-10-09-test'], 'the wall\'s script loads on demand, at craft-mode.js\'s version');
+  assert.equal((wall.innerHTML.match(/class="gx-tag /g) || []).length, 6, 'six doodles');
+  assert.doesNotMatch(wall.innerHTML, /<text/, 'scribbles, not words (owner, 2026-10-09)');
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.match(p.menu().innerHTML, /aria-checked="true" data-review-pick="governing"/, 'the menu checks the live experience');
+  assert.match(p.menu().innerHTML, /data-review-act="stop"/, 'and offers a way out');
+});
+
+test('IT LASTS THE SESSION: a reload keeps the review; a new session starts without one', () => {
+  const session = { ...artist(), 'hall-craft-review': 'ideating' };
+  const p = boot({ session });
+  assert.equal(p.root.dataset.craft, 'ideating', 'a reload wears the experience under review');
+  assert.match(p.side.innerHTML, /data-craft-opt="ideating" aria-pressed="true"/, 'the switch shows the experience being worn');
+  assert.ok(p.byId('craft-graffiti'), 'the wall goes straight back up');
+  const fresh = boot({ session: {}, store: { 'hall-craft-keep': 'artistry' } });
+  assert.equal(fresh.root.dataset.craft, 'artistry', 'a new session is the artist\'s own Artistry');
+  assert.equal(fresh.byId('craft-graffiti'), null);
+  const notArtist = boot({ session: { 'hall-craft': 'building', 'hall-craft-asked': '1', 'hall-craft-review': 'governing' } });
+  assert.equal(notArtist.root.dataset.craft, 'building', 'a stored review outside Artistry is ignored: only an artist reviews');
+  assert.equal(notArtist.craft.reviewing(), null);
+  const junk = boot({ session: { ...artist(), 'hall-craft-review': 'legacy' } });
+  assert.equal(junk.root.dataset.craft, 'artistry', 'a review that is not one of the four reads as none');
+});
+
+test('REVIEWING Ideating shows its own tool too, marked a guest so a tiny phone can fold it away', () => {
+  const p = boot({ session: artist() });
+  p.craft.review('ideating');
+  assert.deepEqual(p.tools(), ['palette', 'paintbrush', 'lightbulb'], 'the artist\'s tools, then the experience\'s own, in order');
+  assert.ok(p.byId('craft-tool-lightbulb').classList.contains('craft-tool--guest'));
+  assert.ok(!p.byId('craft-tool-paintbrush').classList.contains('craft-tool--guest'));
+  p.craft.choose('ideating');
+  assert.deepEqual(p.tools(), ['lightbulb'], 'choosing Ideating for real drops the artist\'s tools');
+  assert.ok(!p.byId('craft-tool-lightbulb').classList.contains('craft-tool--guest'), 'and the lightbulb is no guest any more');
+});
+
+test('ENDING it: Stop reviewing, or any mode from the switch, puts the artist back and takes the wall down', () => {
+  const p = boot({ session: artist() });
+  p.craft.review('building');
+  assert.equal(p.root.dataset.craft, 'building');
+  p.byId('craft-review-more').click({ detail: 1 });
+  p.pick({ 'data-review-act': 'stop' });
+  assert.equal(p.root.dataset.craft, 'artistry', 'Stop reviewing is back in Artistry');
+  assert.equal(p.root.getAttribute('data-craft-review'), null);
+  assert.equal(p.byId('craft-graffiti'), null, 'the wall comes down');
+  assert.equal(p.session['hall-craft-review'], undefined, 'and the session forgets it');
+  assert.ok(!p.byId('craft-tool-palette').classList.contains('craft-tool--reviewing'));
+  p.craft.review('governing');
+  p.craft.choose('artistry');
+  assert.equal(p.craft.reviewing(), null, 'choosing a mode from the switch, even Artistry, ends a review');
+  assert.equal(p.byId('craft-graffiti'), null);
+  p.craft.review('governing');
+  p.craft.choose('governing');
+  assert.equal(p.root.dataset.craft, 'governing');
+  assert.equal(p.root.getAttribute('data-craft-review'), null, 'Governing chosen for real is not a review');
+  assert.equal(p.byId('craft-review'), null, 'and carries no Review pill');
+});
+
+test('THE KEYS: arrows move through the menu, Escape closes it, an outside click closes it', () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.equal(p.docListeners.click && p.docListeners.click.size, 1, 'an open menu listens for a click outside');
+  p.menu().fire('keydown', { key: 'Escape' });
+  assert.ok(!p.menuOpen(), 'Escape closes it');
+  assert.equal(p.docListeners.click.size, 0, 'and stops listening');
+  p.byId('craft-review-more').fire('keydown', { key: 'ArrowDown' });
+  assert.ok(p.menuOpen(), 'ArrowDown on the chevron opens it');
+  [...p.docListeners.click][0]({ target: p.title });
+  assert.ok(!p.menuOpen(), 'a click elsewhere closes it');
+  p.byId('craft-tool-palette').fire('keydown', { key: 'ArrowDown' });
+  assert.ok(p.menuOpen(), 'ArrowDown on Review opens it too');
+  assert.match(CRAFT, /e\.key === 'ArrowUp'/);
+  assert.match(CRAFT, /e\.key === 'Home'/);
+  assert.match(CRAFT, /e\.key === 'End'/);
+});
+
+test('THE WALL is scribbled in CSS only, in ink alone, and stands still under reduced motion', () => {
+  assert.match(STYLE, /@import url\("craft-review\.css"\);/, 'style.css imports the sheet');
+  assert.match(STYLE, /@media \(prefers-reduced-motion: reduce\) \{\s*\*, \*::before, \*::after \{\s*animation: none !important;/, 'the hall\'s kill switch covers it');
+  assert.match(CSS, /\.gx-tag:not\(\.gx-tag--1\):not\(\.gx-tag--2\):not\(\.gx-tag--4\) \.gx-win \{ opacity: 0; \}/, 'the rest frame is three doodles, finished');
+  assert.match(CSS, /\.gx-track \{ animation-name: gx-track; opacity: 0; \}/, 'and no pen');
+  // Each @keyframes body, read to its matching brace.
+  const frames = [...CSS.matchAll(/@keyframes [\w-]+ \{/g)].map((m) => {
+    let depth = 1, i = m.index + m[0].length;
+    for (; i < CSS.length && depth; i++) depth += CSS[i] === '{' ? 1 : CSS[i] === '}' ? -1 : 0;
+    return CSS.slice(m.index + m[0].length, i - 1);
+  });
+  assert.equal(frames.length, 4, 'win, ink, track, scribble');
+  for (const f of frames) {
+    const props = [...f.matchAll(/([a-z-]+)\s*:/g)].map((m) => m[1]);
+    for (const prop of props) assert.ok(['transform', 'opacity'].includes(prop), `a keyframe animates ${prop}`);
+  }
+  assert.doesNotMatch(CSS, /#[0-9a-fA-F]{3,8}\b|rgba?\(/, 'every colour is a token');
+  // Black and white (owner, 2026-10-09): the wall paints with the ink token alone.
+  const wall = CSS.slice(CSS.indexOf('/* ---------- the scribble wall'));
+  assert.ok(wall.length > 200, 'the wall section is found');
+  const paints = new Set([...wall.matchAll(/var\((--[a-z-]+)/g)].map((m) => m[1]).filter((v) => !v.startsWith('--gx-')));
+  assert.deepEqual([...paints], ['--ink'], 'every mark is ink: black on the light bar, white on the dark');
+  assert.doesNotMatch(REVIEW, /requestAnimationFrame|setInterval|\.animate\(/, 'no motion in JavaScript');
+  assert.match(CSS, /@media \(max-width: 359px\) \{ \.craft-tool\.craft-tool--guest \{ display: none; \} \}/, 'two classes, so style.css\'s later .craft-tool cannot win');
+  assert.match(CSS, /@media \(max-width: 640px\) \{ \.craft-graffiti \{ display: none; \} \}/, 'no wall on a phone');
+});
+
+test('craft-review.js draws six small sky doodles, each with its pen, the wide ones foldable', () => {
+  const sandbox = { window: {} };
+  vm.createContext(sandbox);
+  vm.runInContext(REVIEW, sandbox);
+  const api = sandbox.window.OTBCraftReview;
+  const html = api.wallHtml();
+  assert.equal(api.COUNT, 6);
+  assert.equal((html.match(/class="gx-nib"/g) || []).length, 6, 'a pen for every doodle');
+  assert.equal((html.match(/gx-tag--wide/g) || []).length, 2, 'the constellation and the shooting star fold away on a tight wall');
+  const widths = [...html.matchAll(/--gx-w:(\d+)px/g)].map((m) => Number(m[1]));
+  assert.equal(widths.length, 6);
+  assert.ok(widths.every((w) => w <= 56), 'small: no doodle is wider than 56px');
+  assert.equal((html.match(/height="24"/g) || []).length, 6, 'and none taller than 24px');
+  assert.doesNotMatch(html, /<text|style="[^"]*(fill|stroke|color)/, 'no words, and no colour written inline');
+});

package/tests/hall_preview_encoded_paths.mjs

@@ -0,0 +1,81 @@
+// tests/hall_preview_encoded_paths.mjs — the hall preview decodes the API path
+// before matching fixtures and canned writes (task 1004700).
+//
+// The paintbrush sends its page id through encodeURIComponent, so builders:studio
+// arrives as builders%3Astudio. Matched raw, every copy-desk read and canned write
+// 404'd and the bar said "That page could not be taken just now". This boots the
+// real harness and asks for both spellings.
+//
+// Run:  node --test tests/hall_preview_encoded_paths.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import net from 'node:net';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+let child;
+let base;
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer();
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => { const { port } = s.address(); s.close(() => resolve(port)); });
+  });
+}
+
+before(async () => {
+  const port = await freePort();
+  base = `http://127.0.0.1:${port}/api/bongos/copy-desk/pages`;
+  child = spawn(process.execPath, ['scripts/hall-preview/server.js', '--port', String(port), '--fixture-me'], { cwd: ROOT, stdio: ['ignore', 'pipe', 'pipe'] });
+  await new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new Error('hall-preview did not start')), 60000);
+    child.stdout.on('data', (b) => { if (String(b).includes('hall-preview:')) { clearTimeout(t); resolve(); } });
+    child.once('exit', (code) => { clearTimeout(t); reject(new Error(`hall-preview exited ${code}`)); });
+  });
+});
+
+after(() => { if (child) child.kill(); });
+
+async function call(method, id, tail) {
+  const r = await fetch(`${base}/${id}/${tail}`, { method, headers: { 'content-type': 'application/json' }, body: method === 'GET' ? undefined : '{}' });
+  return { status: r.status, body: await r.json() };
+}
+
+test('GET draft: an encoded page id gets the same fixture as the plain one', async () => {
+  const plain = await call('GET', 'builders:studio', 'draft');
+  const encoded = await call('GET', encodeURIComponent('builders:studio'), 'draft');
+  assert.equal(plain.status, 200);
+  assert.equal(encoded.status, 200);
+  assert.deepEqual(encoded.body, plain.body);
+  // and the catch-all, for a page with no fixture of its own
+  const other = await call('GET', encodeURIComponent('builders:work'), 'draft');
+  assert.equal(other.status, 200);
+  assert.deepEqual(other.body, (await call('GET', 'builders:work', 'draft')).body);
+});
+
+test('canned PUT draft: an encoded page id gets the same canned reply as the plain one', async () => {
+  const plain = await call('PUT', 'builders:studio', 'draft');
+  const encoded = await call('PUT', encodeURIComponent('builders:studio'), 'draft');
+  assert.equal(plain.status, 200);
+  assert.equal(encoded.status, 200);
+  assert.deepEqual(encoded.body, plain.body);
+});
+
+test('a decoded backslash or .. segment cannot walk out of the fixtures dir', async () => {
+  for (const id of ['..%5c..%5c..%5cpackage', '..%2F..%2Fpackage', 'a%00b']) {
+    const r = await call('GET', id, 'draft');
+    assert.equal(r.status, 400, id);
+    assert.equal(r.body.error.code, 'bad_path', id);
+  }
+  // the PUT path is checked before CANNED_WRITES too
+  assert.equal((await call('PUT', '..%5cx', 'draft')).status, 400);
+});
+
+test('a malformed escape does not crash the harness', async () => {
+  const r = await call('GET', 'builders%E0%A4%A', 'draft');
+  assert.equal(r.status, 404);
+});

package/tests/page_notes_panel.mjs

@@ -77,7 +77,10 @@ const flush = () => new Promise((r) => setTimeout(r, 0));
 test('THE PALETTE: in the top bar in Artistry alone, right before the switch, and gone when the mode changes', () => {
   const p = boot({ session: { 'hall-craft': 'artistry' } });
   assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette', 'craft-tool-paintbrush'], 'the palette, then the paintbrush (task 1004497)');
-  assert.equal(p.tools()[0].nextSibling, p.tools()[1], 'the palette comes first');
+  // Task 1004686: the palette sits in its split pill (Review + the review-mode chevron).
+  const pill = p.tools()[0].parentNode;
+  assert.equal(pill.id, 'craft-review', 'the palette rides the Review split pill');
+  assert.equal(pill.nextSibling, p.tools()[1], 'the palette comes first');
   assert.equal(p.tools()[1].nextSibling, p.sw, 'and the pair sits right before the mode switch');
   assert.equal(p.tools()[0].getAttribute('aria-label'), 'Artist review: write feedback on this page', 'one name with the public site\'s button (task 1004499)');
   for (const m of ['building', 'governing']) {

package/tests/planning_session_skill.mjs

@@ -83,12 +83,70 @@ test('the mechanics-map step names the subagent mechanism and the retro preceden
   assert.ok(section.includes('task 1003075'));
 });
 
-test('the step is scoped to process-change sessions, not every planning session', () => {
+// task 1004675 (idea 1001074): the step used to read as an opt-in for
+// process-change sessions only, so the sessions with a confident owner model
+// skipped it. It is now the default; skipping is what needs a stated reason.
+function phase15() {
   const start = NORM.indexOf('Phase 1.5 — Map the mechanism');
   const end = NORM.indexOf('Phase 2 — Criteria', start);
-  const section = NORM.slice(start, end === -1 ? undefined : end);
-  assert.ok(/process-change/i.test(section));
-  assert.ok(/skip/i.test(section), 'says explicitly when to skip it');
+  return NORM.slice(start, end === -1 ? undefined : end);
+}
+
+test('the mapping step is the default for any existing surface, and skipping it needs a stated reason', () => {
+  const section = phase15();
+  assert.ok(!/process-change sessions only/i.test(section), 'no longer framed as opt-in for process-change sessions');
+  assert.match(section, /by default for any session that touches an existing surface/);
+  assert.match(section, /Skipping it is the thing that needs a stated reason/);
+  assert.match(section, /confident model/, 'names the confident-owner case as the one most likely to skip');
+});
+
+test('the mapping subagent is always asked the computable-quantity question', () => {
+  assert.match(phase15(), /Name any quantity this design assumes is computable, and say whether it actually is/);
+});
+
+// --- task 1004675: tie criteria to the agreed design --------------------------
+
+function criteriaPhase() {
+  const start = NORM.indexOf('### Phase 2 — Criteria');
+  const end = NORM.indexOf('### Phase 2.5', start);
+  return NORM.slice(start, end);
+}
+
+test('Phase 2 says the grader reads the description and diff, not the spec', () => {
+  const s = criteriaPhase();
+  assert.match(s, /grader reads the \*\*task description and the diff\*\*/);
+  assert.match(s, /does \*\*not\*\* read `docs\/specs\/`/);
+});
+
+test('Phase 2 names the three bindings: model vs rendering, a proof a wrong build fails, cite the design of record', () => {
+  const s = criteriaPhase();
+  assert.match(s, /Split the settled design into MODEL and RENDERING/);
+  assert.match(s, /goes \*\*into the criterion text\*\*/, 'the model goes in the criterion');
+  assert.match(s, /stays in the spec, free to change/, 'the rendering stays in the spec');
+  assert.match(s, /proof whose scenario a wrong build fails/);
+  assert.match(s, /Cite the design of record in every task description, and make sure the builder can open it/);
+  assert.match(s, /private artifact link/, 'warns that an unopenable design of record is decorative');
+});
+
+test('Phase 3 carries the binding into the proof task and every task description', () => {
+  const start = NORM.indexOf('### Phase 3');
+  const s = NORM.slice(start, NORM.indexOf('### Phase 4', start));
+  assert.match(s, /The proof's scenario must be one a wrong build fails/);
+  assert.match(s, /every description cites the design of record/);
+});
+
+test('Phase 4 lays naming options side by side before recommending one', () => {
+  const start = NORM.indexOf('### Phase 4');
+  const s = NORM.slice(start, NORM.indexOf('### Phase 5', start));
+  assert.match(s, /show the options side by side before recommending one/);
+  assert.match(s, /never one name with "or something else\?"/);
+});
+
+test('big design-driven asks are routed to /planning-session before seeding, from both playbooks', () => {
+  const when = NORM.slice(NORM.indexOf('## When to invoke'), NORM.indexOf('## When NOT to invoke'));
+  assert.match(when, /big design-driven ask arrives — route it here BEFORE any task is seeded/);
+  const goal = fs.readFileSync(path.join(ROOT, '.claude/skills/goal-create/SKILL.md'), 'utf8').replace(/\s+/g, ' ');
+  assert.match(goal, /big design-driven ask\*\* .* route it to `\/planning-session` before seeding anything/);
 });
 
 // --- task 1001438: the Phase 5 promote must be scoped to the seeded set -----

package/tests/tweak_batch_apply.mjs

@@ -283,4 +283,20 @@ await test('--batch refuses a task that is not a page tweak', async () => {
   assert.deepEqual(h.writes, []);
 });
 
+// task 1004678 (ADR 0371 D8): the unattended worker names its page with --page.
+await test('--page: a round for a DIFFERENT page is refused with exit 5 before a file is written', async () => {
+  const h = harness({ batch: BATCH() });
+  const code = await apply.batchMain({ taskId: '5001', pageId: 'landing:other' }, h.deps);
+  assert.equal(code, 5, 'exit 5 is the wrong-page halt tweak-halt.js maps');
+  assert.deepEqual(h.writes, [], 'nothing written');
+  assert.equal(h.calls.filter((c) => c.method === 'PATCH').length, 0, 'no applied block recorded');
+});
+
+await test("--page: the round's own page applies as usual", async () => {
+  const h = harness({ batch: BATCH() });
+  const code = await apply.batchMain({ taskId: '5001', pageId: 'landing:fixture', now: () => 't' }, h.deps);
+  assert.equal(code, 0);
+  assert.ok(h.writes.length > 0);
+});
+
 summary();