@bongos/core 1.21.109 → 1.21.111

package/tests/craft_review_mode.mjs

@@ -0,0 +1,307 @@
+// tests/craft_review_mode.mjs — artist review mode (task 1004686, goal 1000095).
+//
+// Owner ask, 2026-10-09: hovering the Review button in Artistry opens a menu of
+// the four experiences (Ideator, Governing, Building, Artistry); picking one
+// puts the artist into review mode on that mode's view, and graffiti is painted
+// across the top bar's empty space while it lasts. These cases run the REAL
+// craft-mode.js (and, when it is loaded, the real craft-review.js) over a small
+// DOM, and read the real craft-review.css for the motion rules.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const CRAFT = read('craft-mode.js');
+const REVIEW = read('craft-review.js');
+const CSS = read('craft-review.css');
+const STYLE = read('style.css');
+
+function node(tag, id, cls) {
+  const attrs = {};
+  const listeners = {};
+  const classes = new Set(String(cls || '').split(/\s+/).filter(Boolean));
+  const el = {
+    tagName: tag, id: id || '', dataset: {}, children: [], parentNode: null, innerHTML: '', title: '', type: '', src: '', textContent: '',
+    get className() { return [...classes].join(' '); }, set className(v) { classes.clear(); String(v).split(/\s+/).filter(Boolean).forEach((c) => classes.add(c)); },
+    classList: {
+      add: (c) => classes.add(c), remove: (c) => classes.delete(c), contains: (c) => classes.has(c),
+      toggle: (c, on) => { if (on === undefined) on = !classes.has(c); if (on) classes.add(c); else classes.delete(c); return on; },
+    },
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    get nextSibling() { const s = this.parentNode && this.parentNode.children; return s ? s[s.indexOf(this) + 1] || null : null; },
+    appendChild(c) { c.parentNode = this; this.children.push(c); if (this.onAppend) this.onAppend(c); return c; },
+    insertBefore(c, ref) { c.parentNode = this; const at = ref ? this.children.indexOf(ref) : -1; if (at === -1) this.children.push(c); else this.children.splice(at, 0, c); return c; },
+    removeChild(c) { this.children.splice(this.children.indexOf(c), 1); c.parentNode = null; return c; },
+    contains(n) { for (let x = n; x; x = x.parentNode) if (x === el) return true; return false; },
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    fire(t, ev = {}) { (listeners[t] || []).forEach((fn) => fn({ target: el, preventDefault() {}, ...ev })); },
+    click(ev) { el.fire('click', ev); },
+    focus() {},
+  };
+  return el;
+}
+function all(root) { return root.children.flatMap((c) => [c, ...all(c)]); }
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+// One page load. Pass the same `session` to a second boot and it is a reload.
+function boot({ session = {}, store = {}, narrow = false } = {}) {
+  const sidebar = node('NAV', 'app-sidebar');
+  const topbar = node('DIV', 'app-topbar');
+  const title = topbar.appendChild(node('H2', 'topbar-title'));
+  const side = topbar.appendChild(node('DIV', '', 'topbar-side'));
+  const sw = side.appendChild(node('DIV', 'craft-switch'));
+  const head = node('HEAD');
+  const root = node('HTML');
+  const loaded = [];
+  const opened = [];
+  const docListeners = {};
+  const everything = () => [sidebar, topbar, ...all(sidebar), ...all(topbar)];
+  const document = {
+    documentElement: root, body: node('BODY'), head, activeElement: null,
+    currentScript: { src: 'https://h/builders/craft-mode.js?v=2026-10-09-test' },
+    getElementById: (id) => everything().find((n) => n.id === id) || null,
+    querySelector: (sel) => (sel === '#app-topbar > .topbar-side' ? side : null),
+    querySelectorAll: (sel) => (sel === '[data-craft-tool]' ? everything().filter((n) => n.hasAttribute('data-craft-tool')) : []),
+    createElement: (t) => node(t.toUpperCase()),
+    addEventListener(t, fn) { (docListeners[t] ||= new Set()).add(fn); },
+    removeEventListener(t, fn) { if (docListeners[t]) docListeners[t].delete(fn); },
+    dispatchEvent() { return true; },
+  };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const window = { localStorage: mk(store), sessionStorage: mk(session), matchMedia: (q) => ({ matches: narrow && /max-width: 640px/.test(q) }), location: { search: '' } };
+  const sandbox = { window, document, Promise, setTimeout, clearTimeout, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  vm.createContext(sandbox);
+  // "Loading" a script: the wall runs the REAL craft-review.js; the palette is a fake panel.
+  head.onAppend = (tag) => {
+    loaded.push(tag.src);
+    if (/craft-review\.js/.test(tag.src)) vm.runInContext(REVIEW, sandbox, { filename: 'craft-review.js' });
+    else window.OTBPageNotes = { open: () => opened.push('open'), openNote: () => {} };
+    tag.onload();
+  };
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  side.innerHTML = window.OTBCraftMode.switchHtml();
+  window.OTBCraftMode.mount();
+  const byId = (id) => document.getElementById(id);
+  return {
+    craft: window.OTBCraftMode, root, topbar, side, sw, title, loaded, opened, session, byId, docListeners,
+    tools: () => all(side).filter((n) => n.hasAttribute('data-craft-tool')).map((n) => n.id.replace('craft-tool-', '')),
+    menu: () => byId('craft-review-menu'),
+    menuOpen: () => !!byId('craft-review-menu') && !byId('craft-review-menu').hasAttribute('hidden'),
+    // A click on a menu item: the menu's own listener reads the button off the target.
+    pick: (attrs) => byId('craft-review-menu').fire('click', { target: { closest: () => ({ getAttribute: (k) => (k in attrs ? attrs[k] : null) }) } }),
+  };
+}
+const artist = () => ({ 'hall-craft': 'artistry', 'hall-craft-asked': '1' });
+
+test('THE SPLIT PILL: in Artistry, Review rides a group with a review-mode chevron and a closed menu', () => {
+  const p = boot({ session: artist() });
+  const pill = p.byId('craft-review');
+  assert.ok(pill, 'the group exists');
+  assert.equal(p.byId('craft-tool-palette').parentNode, pill, 'Review sits in it');
+  const more = p.byId('craft-review-more');
+  assert.equal(more.parentNode, pill);
+  assert.equal(more.getAttribute('aria-haspopup'), 'menu');
+  assert.equal(more.getAttribute('aria-expanded'), 'false');
+  assert.equal(more.getAttribute('aria-controls'), 'craft-review-menu');
+  assert.equal(p.menu().getAttribute('role'), 'menu');
+  assert.ok(p.menu().hasAttribute('hidden'), 'the menu starts closed');
+  assert.equal(p.byId('craft-graffiti'), null, 'no wall until a review starts');
+  assert.equal(p.root.getAttribute('data-craft-review'), null);
+  for (const m of ['building', 'ideating', 'governing']) {
+    p.craft.choose(m);
+    assert.equal(p.byId('craft-review'), null, `no Review pill in ${m}`);
+  }
+});
+
+test('THE MENU: write feedback first, then the four experiences in the owner\'s order and words', () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.ok(p.menuOpen(), 'the chevron opens it');
+  assert.equal(p.byId('craft-review-more').getAttribute('aria-expanded'), 'true');
+  const html = p.menu().innerHTML;
+  const labels = [...html.matchAll(/<span>([^<]+)<\/span>/g)].map((m) => m[1]);
+  assert.deepEqual(labels, ['Write feedback on this page', 'Ideator experience', 'Governing experience', 'Building experience', 'Artistry experience']);
+  assert.deepEqual([...html.matchAll(/data-review-pick="([a-z]+)"/g)].map((m) => m[1]), ['ideating', 'governing', 'building', 'artistry']);
+  assert.equal((html.match(/role="menuitemradio" aria-checked="true"/g) || []).length, 0, 'nothing is checked before a review');
+  assert.doesNotMatch(html, /Stop reviewing/, 'no way out of a review that has not started');
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.ok(!p.menuOpen(), 'the chevron closes it again');
+});
+
+test('HOVER opens it for a mouse, never for a touch, and leaving closes it after a beat', async () => {
+  const p = boot({ session: artist() });
+  const pill = p.byId('craft-review');
+  pill.fire('pointerenter', { pointerType: 'touch' });
+  assert.ok(!p.menuOpen(), 'a touch is not a hover');
+  pill.fire('pointerenter', { pointerType: 'mouse' });
+  assert.ok(p.menuOpen(), 'a mouse over the pill opens the menu');
+  pill.fire('pointerleave', { pointerType: 'mouse' });
+  assert.ok(p.menuOpen(), 'it stays a beat, so the pointer can reach the menu');
+  pill.fire('pointerenter', { pointerType: 'mouse' });
+  await new Promise((r) => setTimeout(r, 260));
+  assert.ok(p.menuOpen(), 'coming back in cancels the close');
+  pill.fire('pointerleave', { pointerType: 'mouse' });
+  await new Promise((r) => setTimeout(r, 260));
+  assert.ok(!p.menuOpen(), 'and leaving for good closes it');
+});
+
+test('CLICKING Review still opens the feedback panel; on a phone a tap opens the menu instead', async () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-tool-palette').click({ detail: 1 });
+  await flush();
+  assert.deepEqual(p.opened, ['open'], 'the feedback doc opens, as before');
+  assert.ok(!p.menuOpen());
+  const phone = boot({ session: artist(), narrow: true });
+  phone.byId('craft-tool-palette').click({ detail: 1 });
+  await flush();
+  assert.deepEqual(phone.opened, [], 'no panel on the tap');
+  assert.ok(phone.menuOpen(), 'the menu instead (a phone has no hover)');
+  phone.pick({ 'data-review-act': 'write' });
+  await flush();
+  assert.deepEqual(phone.opened, ['open'], 'and its first line opens the feedback doc');
+});
+
+test('PICKING an experience: the hall wears that mode, the artist keeps the Review tools, and the wall goes up', async () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  p.pick({ 'data-review-pick': 'governing' });
+  assert.ok(!p.menuOpen(), 'the menu closes on a pick');
+  assert.equal(p.root.dataset.craft, 'governing', 'the hall wears Governing: its tabs, look and tallies follow');
+  assert.equal(p.root.getAttribute('data-craft-review'), 'governing');
+  assert.equal(p.craft.current(), 'governing');
+  assert.equal(p.craft.reviewing(), 'governing');
+  assert.equal(p.session['hall-craft'], 'artistry', 'the artist\'s own mode stays Artistry');
+  assert.equal(p.session['hall-craft-review'], 'governing', 'the review lasts the session');
+  assert.deepEqual(p.tools(), ['palette', 'paintbrush'], 'Review and Edit words stay in the bar');
+  assert.ok(p.byId('craft-tool-palette').classList.contains('craft-tool--reviewing'));
+  const wall = p.byId('craft-graffiti');
+  assert.ok(wall, 'the graffiti wall is up');
+  assert.equal(wall.parentNode, p.topbar, 'in the top bar');
+  assert.equal(wall.nextSibling, p.side, 'in the empty space before the controls');
+  assert.equal(wall.getAttribute('aria-hidden'), 'true', 'decorative');
+  await flush();
+  assert.deepEqual(p.loaded, ['/builders/craft-review.js?v=2026-10-09-test'], 'the wall\'s script loads on demand, at craft-mode.js\'s version');
+  assert.equal((wall.innerHTML.match(/class="gx-tag /g) || []).length, 6, 'six doodles');
+  assert.doesNotMatch(wall.innerHTML, /<text/, 'scribbles, not words (owner, 2026-10-09)');
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.match(p.menu().innerHTML, /aria-checked="true" data-review-pick="governing"/, 'the menu checks the live experience');
+  assert.match(p.menu().innerHTML, /data-review-act="stop"/, 'and offers a way out');
+});
+
+test('IT LASTS THE SESSION: a reload keeps the review; a new session starts without one', () => {
+  const session = { ...artist(), 'hall-craft-review': 'ideating' };
+  const p = boot({ session });
+  assert.equal(p.root.dataset.craft, 'ideating', 'a reload wears the experience under review');
+  assert.match(p.side.innerHTML, /data-craft-opt="ideating" aria-pressed="true"/, 'the switch shows the experience being worn');
+  assert.ok(p.byId('craft-graffiti'), 'the wall goes straight back up');
+  const fresh = boot({ session: {}, store: { 'hall-craft-keep': 'artistry' } });
+  assert.equal(fresh.root.dataset.craft, 'artistry', 'a new session is the artist\'s own Artistry');
+  assert.equal(fresh.byId('craft-graffiti'), null);
+  const notArtist = boot({ session: { 'hall-craft': 'building', 'hall-craft-asked': '1', 'hall-craft-review': 'governing' } });
+  assert.equal(notArtist.root.dataset.craft, 'building', 'a stored review outside Artistry is ignored: only an artist reviews');
+  assert.equal(notArtist.craft.reviewing(), null);
+  const junk = boot({ session: { ...artist(), 'hall-craft-review': 'legacy' } });
+  assert.equal(junk.root.dataset.craft, 'artistry', 'a review that is not one of the four reads as none');
+});
+
+test('REVIEWING Ideating shows its own tool too, marked a guest so a tiny phone can fold it away', () => {
+  const p = boot({ session: artist() });
+  p.craft.review('ideating');
+  assert.deepEqual(p.tools(), ['palette', 'paintbrush', 'lightbulb'], 'the artist\'s tools, then the experience\'s own, in order');
+  assert.ok(p.byId('craft-tool-lightbulb').classList.contains('craft-tool--guest'));
+  assert.ok(!p.byId('craft-tool-paintbrush').classList.contains('craft-tool--guest'));
+  p.craft.choose('ideating');
+  assert.deepEqual(p.tools(), ['lightbulb'], 'choosing Ideating for real drops the artist\'s tools');
+  assert.ok(!p.byId('craft-tool-lightbulb').classList.contains('craft-tool--guest'), 'and the lightbulb is no guest any more');
+});
+
+test('ENDING it: Stop reviewing, or any mode from the switch, puts the artist back and takes the wall down', () => {
+  const p = boot({ session: artist() });
+  p.craft.review('building');
+  assert.equal(p.root.dataset.craft, 'building');
+  p.byId('craft-review-more').click({ detail: 1 });
+  p.pick({ 'data-review-act': 'stop' });
+  assert.equal(p.root.dataset.craft, 'artistry', 'Stop reviewing is back in Artistry');
+  assert.equal(p.root.getAttribute('data-craft-review'), null);
+  assert.equal(p.byId('craft-graffiti'), null, 'the wall comes down');
+  assert.equal(p.session['hall-craft-review'], undefined, 'and the session forgets it');
+  assert.ok(!p.byId('craft-tool-palette').classList.contains('craft-tool--reviewing'));
+  p.craft.review('governing');
+  p.craft.choose('artistry');
+  assert.equal(p.craft.reviewing(), null, 'choosing a mode from the switch, even Artistry, ends a review');
+  assert.equal(p.byId('craft-graffiti'), null);
+  p.craft.review('governing');
+  p.craft.choose('governing');
+  assert.equal(p.root.dataset.craft, 'governing');
+  assert.equal(p.root.getAttribute('data-craft-review'), null, 'Governing chosen for real is not a review');
+  assert.equal(p.byId('craft-review'), null, 'and carries no Review pill');
+});
+
+test('THE KEYS: arrows move through the menu, Escape closes it, an outside click closes it', () => {
+  const p = boot({ session: artist() });
+  p.byId('craft-review-more').click({ detail: 1 });
+  assert.equal(p.docListeners.click && p.docListeners.click.size, 1, 'an open menu listens for a click outside');
+  p.menu().fire('keydown', { key: 'Escape' });
+  assert.ok(!p.menuOpen(), 'Escape closes it');
+  assert.equal(p.docListeners.click.size, 0, 'and stops listening');
+  p.byId('craft-review-more').fire('keydown', { key: 'ArrowDown' });
+  assert.ok(p.menuOpen(), 'ArrowDown on the chevron opens it');
+  [...p.docListeners.click][0]({ target: p.title });
+  assert.ok(!p.menuOpen(), 'a click elsewhere closes it');
+  p.byId('craft-tool-palette').fire('keydown', { key: 'ArrowDown' });
+  assert.ok(p.menuOpen(), 'ArrowDown on Review opens it too');
+  assert.match(CRAFT, /e\.key === 'ArrowUp'/);
+  assert.match(CRAFT, /e\.key === 'Home'/);
+  assert.match(CRAFT, /e\.key === 'End'/);
+});
+
+test('THE WALL is scribbled in CSS only, in ink alone, and stands still under reduced motion', () => {
+  assert.match(STYLE, /@import url\("craft-review\.css"\);/, 'style.css imports the sheet');
+  assert.match(STYLE, /@media \(prefers-reduced-motion: reduce\) \{\s*\*, \*::before, \*::after \{\s*animation: none !important;/, 'the hall\'s kill switch covers it');
+  assert.match(CSS, /\.gx-tag:not\(\.gx-tag--1\):not\(\.gx-tag--2\):not\(\.gx-tag--4\) \.gx-win \{ opacity: 0; \}/, 'the rest frame is three doodles, finished');
+  assert.match(CSS, /\.gx-track \{ animation-name: gx-track; opacity: 0; \}/, 'and no pen');
+  // Each @keyframes body, read to its matching brace.
+  const frames = [...CSS.matchAll(/@keyframes [\w-]+ \{/g)].map((m) => {
+    let depth = 1, i = m.index + m[0].length;
+    for (; i < CSS.length && depth; i++) depth += CSS[i] === '{' ? 1 : CSS[i] === '}' ? -1 : 0;
+    return CSS.slice(m.index + m[0].length, i - 1);
+  });
+  assert.equal(frames.length, 4, 'win, ink, track, scribble');
+  for (const f of frames) {
+    const props = [...f.matchAll(/([a-z-]+)\s*:/g)].map((m) => m[1]);
+    for (const prop of props) assert.ok(['transform', 'opacity'].includes(prop), `a keyframe animates ${prop}`);
+  }
+  assert.doesNotMatch(CSS, /#[0-9a-fA-F]{3,8}\b|rgba?\(/, 'every colour is a token');
+  // Black and white (owner, 2026-10-09): the wall paints with the ink token alone.
+  const wall = CSS.slice(CSS.indexOf('/* ---------- the scribble wall'));
+  assert.ok(wall.length > 200, 'the wall section is found');
+  const paints = new Set([...wall.matchAll(/var\((--[a-z-]+)/g)].map((m) => m[1]).filter((v) => !v.startsWith('--gx-')));
+  assert.deepEqual([...paints], ['--ink'], 'every mark is ink: black on the light bar, white on the dark');
+  assert.doesNotMatch(REVIEW, /requestAnimationFrame|setInterval|\.animate\(/, 'no motion in JavaScript');
+  assert.match(CSS, /@media \(max-width: 359px\) \{ \.craft-tool\.craft-tool--guest \{ display: none; \} \}/, 'two classes, so style.css\'s later .craft-tool cannot win');
+  assert.match(CSS, /@media \(max-width: 640px\) \{ \.craft-graffiti \{ display: none; \} \}/, 'no wall on a phone');
+});
+
+test('craft-review.js draws six small sky doodles, each with its pen, the wide ones foldable', () => {
+  const sandbox = { window: {} };
+  vm.createContext(sandbox);
+  vm.runInContext(REVIEW, sandbox);
+  const api = sandbox.window.OTBCraftReview;
+  const html = api.wallHtml();
+  assert.equal(api.COUNT, 6);
+  assert.equal((html.match(/class="gx-nib"/g) || []).length, 6, 'a pen for every doodle');
+  assert.equal((html.match(/gx-tag--wide/g) || []).length, 2, 'the constellation and the shooting star fold away on a tight wall');
+  const widths = [...html.matchAll(/--gx-w:(\d+)px/g)].map((m) => Number(m[1]));
+  assert.equal(widths.length, 6);
+  assert.ok(widths.every((w) => w <= 56), 'small: no doodle is wider than 56px');
+  assert.equal((html.match(/height="24"/g) || []).length, 6, 'and none taller than 24px');
+  assert.doesNotMatch(html, /<text|style="[^"]*(fill|stroke|color)/, 'no words, and no colour written inline');
+});

package/tests/page_notes_panel.mjs

@@ -77,7 +77,10 @@ const flush = () => new Promise((r) => setTimeout(r, 0));
 test('THE PALETTE: in the top bar in Artistry alone, right before the switch, and gone when the mode changes', () => {
   const p = boot({ session: { 'hall-craft': 'artistry' } });
   assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette', 'craft-tool-paintbrush'], 'the palette, then the paintbrush (task 1004497)');
-  assert.equal(p.tools()[0].nextSibling, p.tools()[1], 'the palette comes first');
+  // Task 1004686: the palette sits in its split pill (Review + the review-mode chevron).
+  const pill = p.tools()[0].parentNode;
+  assert.equal(pill.id, 'craft-review', 'the palette rides the Review split pill');
+  assert.equal(pill.nextSibling, p.tools()[1], 'the palette comes first');
   assert.equal(p.tools()[1].nextSibling, p.sw, 'and the pair sits right before the mode switch');
   assert.equal(p.tools()[0].getAttribute('aria-label'), 'Artist review: write feedback on this page', 'one name with the public site\'s button (task 1004499)');
   for (const m of ['building', 'governing']) {

package/tests/tweak_batch_apply.mjs

@@ -283,4 +283,20 @@ await test('--batch refuses a task that is not a page tweak', async () => {
   assert.deepEqual(h.writes, []);
 });
 
+// task 1004678 (ADR 0371 D8): the unattended worker names its page with --page.
+await test('--page: a round for a DIFFERENT page is refused with exit 5 before a file is written', async () => {
+  const h = harness({ batch: BATCH() });
+  const code = await apply.batchMain({ taskId: '5001', pageId: 'landing:other' }, h.deps);
+  assert.equal(code, 5, 'exit 5 is the wrong-page halt tweak-halt.js maps');
+  assert.deepEqual(h.writes, [], 'nothing written');
+  assert.equal(h.calls.filter((c) => c.method === 'PATCH').length, 0, 'no applied block recorded');
+});
+
+await test("--page: the round's own page applies as usual", async () => {
+  const h = harness({ batch: BATCH() });
+  const code = await apply.batchMain({ taskId: '5001', pageId: 'landing:fixture', now: () => 't' }, h.deps);
+  assert.equal(code, 0);
+  assert.ok(h.writes.length > 0);
+});
+
 summary();

package/tests/tweak_unattended.mjs

@@ -0,0 +1,274 @@
+// tests/tweak_unattended.mjs — /tweak --page <id> --unattended halts by releasing,
+// and the server, not the worker, holds its rules (task 1004678 / BV2.TW19b,
+// ADR 0371 D8).
+//
+//   1. tweak-halt.js: every halt releases the round with fixed wording, and
+//      copy-apply's exits map onto those halts;
+//   2. NO LAND WITHOUT THE ARTIST: every statement in the lifecycle that writes
+//      status 'confirmed' is enumerated from the source, and each one is either
+//      the artist's approval, the owner's override, or refuses a page tweak.
+//      confirmTask (the --skip-grade / grader-bypass path) is driven for real;
+//   3. NO FILE OUTSIDE THE PAGE: autopickup-files.js over the server's own read of
+//      the pull request's files, and the real publish route refusing (409, PR
+//      closed, never armed) when an auto_pickup round strays.
+// No DB, no network: fake pools, the real router, stubbed GitHub reads.
+//
+// Run:  node tests/tweak_unattended.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const { test, summary } = makeRunner();
+
+// ---- 1. halts ---------------------------------------------------------------
+
+const halt = require('../scripts/gds/tweak-halt.js');
+
+await test('each ADR 0371 D8 halt has fixed wording; an unknown code has none', () => {
+  for (const code of ['claim_refused', 'nothing_applied', 'ship_check_stale', 'grader_unavailable']) {
+    assert.equal(typeof halt.haltNote(code), 'string', code);
+  }
+  assert.equal(halt.haltNote('anything the worker says'), null);
+  assert.throws(() => halt.releaseWithNote(9, 'free text', { spawn: () => ({ status: 0 }) }), /unknown halt code/);
+});
+
+await test('copy-apply exits map to halts; a clean apply is not a halt', () => {
+  assert.equal(halt.haltForCopyApplyExit(0), null);
+  assert.equal(halt.haltForCopyApplyExit(2), 'nothing_applied');
+  assert.equal(halt.haltForCopyApplyExit(3), 'registry_mismatch');
+  assert.equal(halt.haltForCopyApplyExit(4), 'reread_failed');
+  assert.equal(halt.haltForCopyApplyExit(5), 'wrong_page');
+  assert.equal(halt.haltForCopyApplyExit(99), 'nothing_applied', 'an unknown failure still halts');
+});
+
+await test('a halt RELEASES the round through release.js, with the fixed note as its reason', () => {
+  const calls = [];
+  const exit = halt.releaseWithNote(4321, 'grader_unavailable', { spawn: (cmd, argv) => { calls.push(argv); return { status: 0 }; } });
+  assert.equal(exit, 0);
+  assert.equal(calls.length, 1);
+  const [script, task, flag, reason] = calls[0];
+  assert.match(script.replace(/\\/g, '/'), /scripts\/gds\/release\.js$/);
+  assert.equal(task, '4321');
+  assert.equal(flag, '--reason');
+  assert.equal(reason, `[tweak-unattended:grader_unavailable] ${halt.HALT_NOTES.grader_unavailable}`);
+});
+
+await test('copy-apply --unattended releases on every non-zero batch exit (wired, not just documented)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/copy-apply.js'), 'utf8');
+  const at = src.indexOf("hasFlag('--unattended') && code !== 0");
+  assert.ok(at > 0, 'the unattended branch tests every non-zero exit');
+  assert.ok(src.slice(at, at + 300).includes('halt.releaseWithNote(taskId, halt.haltForCopyApplyExit(code))'), 'and releases through tweak-halt');
+  assert.match(src, /arg\('--page'\)/);
+});
+
+await test('the skill documents the mode and never offers --skip-grade to it', () => {
+  const skill = fs.readFileSync(path.join(ROOT, 'modules/copy-desk/skills/tweak/SKILL.md'), 'utf8');
+  const section = skill.slice(skill.indexOf('## Unattended mode'), skill.indexOf('## What happens next'));
+  assert.ok(section.length > 200, 'the unattended section exists');
+  assert.match(section, /--page <page-id> --unattended/);
+  assert.match(section, /tweak-halt\.js/);
+  assert.match(section, /Never `--skip-grade`/);
+});
+
+// ---- 2. no land without the artist -----------------------------------------
+
+const achievements = require('../modules/economy/achievements.js');
+achievements.evaluateAfterShip = async () => [];
+achievements.evaluateAfterCreditAward = async () => [];
+achievements.evaluateAfterClaim = async () => [];
+achievements.reconcileBuilderAchievements = async () => [];
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const db = require('../modules/lifecycle/db.js');
+
+// Every lifecycle statement that sets a TASK to confirmed, found from the source.
+// A new one reds this test until it is listed below with why it holds.
+const CONFIRM_WRITERS = {
+  'db-grade.js': 'promoteToConfirmed: applyGrade withholds it for a page tweak (isPageTweak), approveHeldTweak is the artist',
+  'db-overrides.js': "decideOverrideRequest: the owner's override request",
+  'db-ship.js': 'confirmTask: refuses a page tweak (PAGE_TWEAK_NEEDS_ARTIST)',
+};
+
+await test('every confirm path in the lifecycle is listed, and each holds the artist gate', () => {
+  const dir = path.join(ROOT, 'modules/lifecycle');
+  const found = [];
+  for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.js'))) {
+    const src = fs.readFileSync(path.join(dir, f), 'utf8');
+    const n = (src.match(/UPDATE tasks\s+SET status = 'confirmed'/g) || []).length;
+    for (let i = 0; i < n; i++) found.push(f);
+  }
+  assert.deepEqual(found.sort(), Object.keys(CONFIRM_WRITERS).sort(), 'one confirm write per listed file, and no other');
+  const grade = fs.readFileSync(path.join(dir, 'db-grade.js'), 'utf8');
+  assert.match(grade, /held = tweakHold\.isPageTweak/);
+  assert.match(grade, /gradeResult\.passed && task\.status === 'completed' && !held/);
+  const approve = fs.readFileSync(path.join(dir, 'page-tweak-approve.js'), 'utf8');
+  assert.match(approve, /isHeldForArtist/, 'approve runs the promotion only on a held round');
+});
+
+function confirmPool(source) {
+  return makeSqlAwareClient((s) => {
+    if (/SELECT builder_id FROM claims/.test(s)) return { rows: [{ builder_id: 25 }] };
+    if (/^SELECT source FROM tasks/.test(s)) return { rows: [{ source }] };
+    if (/^UPDATE tasks/.test(s)) return { rows: [{ id: 7, title: 't', credits_reward: 10, kind: 'feature' }] };
+    return { rows: [] };
+  });
+}
+
+await test('confirmTask (the --skip-grade path) REFUSES a page tweak and writes nothing', async () => {
+  const pool = confirmPool('page-tweak');
+  await assert.rejects(() => db.confirmTask({ taskId: 7, builderId: 1 }, { pool }), (e) => e.code === 'PAGE_TWEAK_NEEDS_ARTIST');
+  assert.ok(!pool._client.queries.some((q) => /^\s*UPDATE tasks/.test(String(q.sql))), 'no status write');
+});
+
+await test('confirmTask on every other task confirms as before', async () => {
+  for (const source of ['planning-session', 'page-tweak-unplaced', null]) {
+    const out = await db.confirmTask({ taskId: 7, builderId: 1 }, { pool: confirmPool(source) });
+    assert.equal(out.taskStatus, 'confirmed', String(source));
+  }
+});
+
+await test('POST /tasks/:id/confirm maps the refusal to a 409 that names the artist', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+  assert.match(src, /err\.code === 'PAGE_TWEAK_NEEDS_ARTIST'\) return res\.fail\('page_tweak_needs_artist', \{ status: 409/);
+});
+
+// ---- 3. no file outside the page -------------------------------------------
+
+const apf = require('../modules/lifecycle/autopickup-files.js');
+const pcheck = require('../src/bongos/permission-path-check.js');
+const INV = { pages: [{ id: 'landing:index', files: ['modules/public-landing/public/index.html', 'modules/public-landing/public/landing.css'], states_files: ['modules/public-landing/public/index.states.json'] }] };
+const ROUND = { id: 7, source: 'page-tweak', source_ref: 'page-tweak/landing:index/r2', auto_pickup: true };
+const files = (...p) => p.map((x) => ({ path: x }));
+const run = (over = {}, deps = {}) => apf.autoPickupFileRefusal({ taskId: 7, prNumber: 77 }, {
+  readRound: async () => ({ ...ROUND, ...over }),
+  readInventory: () => INV,
+  getPullRequestFiles: async () => files('modules/public-landing/public/index.html', 'docs/copy-registry.json', 'docs/page-readings.json'),
+  matchProtected: pcheck.matchProtected,
+  ...deps,
+});
+
+await test('an auto_pickup round touching only its page and the regenerated files publishes', async () => {
+  assert.equal(await run(), null);
+});
+
+await test('a file outside the page is refused and named', async () => {
+  const r = await run({}, { getPullRequestFiles: async () => files('modules/public-landing/public/index.html', 'modules/hall-ui/public/goals.js') });
+  assert.equal(r.code, 'auto_pickup_outside_page');
+  assert.deepEqual(r.outside, ['modules/hall-ui/public/goals.js']);
+  assert.match(apf.refusalMessage(r), /goals\.js/);
+});
+
+await test('a protected path is refused even when it is on the regenerated list', async () => {
+  const r = await run({}, { getPullRequestFiles: async () => files('modules/public-landing/public/index.html', 'CLAUDE.md') });
+  assert.equal(r.code, 'auto_pickup_outside_page');
+  assert.deepEqual(r.protected, ['CLAUDE.md']);
+});
+
+await test('fail closed: unreadable files, a list at the cap, an unknown page, a bad ref', async () => {
+  assert.equal((await run({}, { getPullRequestFiles: async () => { throw new Error('502'); } })).code, 'auto_pickup_files_unreadable');
+  const cap = Array.from({ length: 300 }, () => ({ path: 'modules/public-landing/public/index.html' }));
+  assert.equal((await run({}, { getPullRequestFiles: async () => cap })).code, 'auto_pickup_files_unreadable');
+  assert.equal((await run({ source_ref: 'page-tweak/landing:gone/r1' })).code, 'auto_pickup_page_unknown');
+  assert.equal((await run({ source_ref: 'nonsense' })).code, 'auto_pickup_page_unknown');
+  assert.equal((await run({}, { readInventory: () => { throw new Error('ENOENT'); } })).code, 'auto_pickup_page_unknown');
+});
+
+await test('an UNMARKED claim, or any other task, is never checked (no GitHub read)', async () => {
+  let reads = 0;
+  const count = { getPullRequestFiles: async () => { reads++; return files('anything.js'); } };
+  assert.equal(await run({ auto_pickup: false }, count), null);
+  assert.equal(await run({ auto_pickup: null }, count), null);
+  assert.equal(await run({ source: 'planning-session' }, count), null);
+  assert.equal(await apf.autoPickupFileRefusal({ taskId: 7, prNumber: 77 }, { readRound: async () => null, ...count }), null);
+  assert.equal(reads, 0);
+});
+
+await test('the round read is one query naming the latest claim\'s mark', async () => {
+  const pool = makeSqlAwareClient(() => ({ rows: [ROUND] }));
+  const r = await apf.readRound(7, pool._client || pool);
+  assert.equal(r.auto_pickup, true);
+  const q = (pool._client || pool).queries.map((x) => String(x.sql).replace(/\s+/g, ' '));
+  assert.equal(q.length, 1);
+  assert.match(q[0], /SELECT c\.auto_pickup FROM claims c WHERE c\.task_id = t\.id ORDER BY c\.claimed_at DESC, c\.id DESC LIMIT 1/);
+});
+
+await test('the page files come from the real inventory for a real page', () => {
+  const inv = JSON.parse(fs.readFileSync(path.join(ROOT, 'docs/page-inventory.json'), 'utf8'));
+  const page = inv.pages.find((p) => (p.files || []).length);
+  assert.ok(apf.pageFiles(inv, page.id).includes(page.files[0]));
+  assert.equal(apf.pageFiles(inv, 'nope:nope'), null);
+});
+
+// The real publish route.
+const express = require('express');
+const api = require('../src/module-api.js');
+const gp = require('../modules/lifecycle/github-push.js');
+const prAssign = require('../modules/lifecycle/pr-assign.js');
+const prClose = require('../modules/lifecycle/github-pr-close.js');
+const pageTweakReads = require('../modules/lifecycle/page-tweak-reads.js');
+
+let round = ROUND;
+let prFiles = files('modules/public-landing/public/index.html');
+let armCalls = 0, closed = [];
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'archon', github_login: 'the-archon' }; next(); };
+db.getLastClaimHolder = async () => ({ builder_id: 5, github_login: 'some-builder' });
+db.setClaimPublishedSha = async () => {};
+api.pool.query = async () => ({ rows: [round] });
+gp.isConfigured = () => true;
+gp.pushBundle = async () => ({ head_sha: 'a'.repeat(40) });
+gp.openOrFindPullRequest = async () => ({ number: 77, url: 'https://github.com/o/r/pull/77', node_id: 'N' });
+gp.enableAutoMergeDetailed = async () => { armCalls++; return { ok: true }; };
+gp.getPullRequestFiles = async () => prFiles;
+gp.setCommitStatus = async () => true;
+prAssign.assignPullRequest = async () => ({ assigned: true });
+prClose.closePullRequest = async ({ number }) => { closed.push(number); return { ok: true }; };
+pageTweakReads.heldForArtistFailClosed = async () => true;
+
+const app = express();
+app.use((req, res, next) => { res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) }); next(); });
+app.use(require('../modules/lifecycle/routes/tasks.js')());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const publish = async () => {
+  const res = await fetch(`${base}/tasks/7/publish-branch`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ branch: 'task-7', head_sha: 'a'.repeat(40), bundle_b64: Buffer.from('b').toString('base64'), value_summary: 'Page tweak.' }),
+  });
+  return { status: res.status, body: await res.json() };
+};
+
+await test('publish: an auto_pickup round that strays is REFUSED 409, its PR closed, never armed', async () => {
+  round = ROUND; prFiles = files('modules/public-landing/public/index.html', 'src/server.js'); armCalls = 0; closed = [];
+  const r = await publish();
+  assert.equal(r.status, 409, JSON.stringify(r.body));
+  assert.equal(r.body.error, 'auto_pickup_outside_page');
+  assert.ok(r.body.outside.includes('src/server.js'));
+  assert.deepEqual(closed, [77]);
+  assert.equal(armCalls, 0);
+});
+
+await test('publish: an auto_pickup round inside its page publishes (held, so not armed)', async () => {
+  round = ROUND; prFiles = files('modules/public-landing/public/index.html'); closed = [];
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.deepEqual(closed, []);
+});
+
+await test('publish: an ordinary task is not checked, whatever its files', async () => {
+  round = { id: 7, source: 'planning-session', source_ref: null, auto_pickup: null }; prFiles = files('src/server.js'); closed = [];
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.deepEqual(closed, []);
+});
+server.close();
+
+summary();