@bongos/core 1.21.112 → 1.21.114

package/tests/landing_page.mjs

@@ -568,15 +568,16 @@ test('the Projects band deep-links the hub\'s views; About and Docs are footer l
   // the profile band: the person, My projects, Account, Sign out as the honest anchor.
   // Account fills the slot that waited for a settings page (task 1004259) and is
   // apex-only, because /account is served only where platform-identity runs; so is
-  // Invitations, in the same region, for /invitations (task 1004276).
+  // Invitations, in the same region, for /invitations (task 1004276), and Connections
+  // for /connections (task 1004278).
   assert.match(body, /<div class="menuBand" id="menuProfile" data-menu="profile" hidden>/);
   assert.match(body, /<p class="bandWho" id="bandWho"><\/p>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=mine">My projects<\/a>/);
-  assert.match(body, /<!--apex-only:start--><li class="bandCell"><a class="bandT" href="\/invitations">Invitations<\/a><\/li><li class="bandCell"><a class="bandT" href="\/account">Account<\/a><\/li><!--apex-only:end-->/);
+  assert.match(body, /<!--apex-only:start--><li class="bandCell"><a class="bandT" href="\/invitations">Invitations<\/a><\/li><li class="bandCell"><a class="bandT" href="\/connections">Connections<\/a><\/li><li class="bandCell"><a class="bandT" href="\/account">Account<\/a><\/li><!--apex-only:end-->/);
   assert.doesNotMatch(body, /class="bandSlot"/, 'the slot is filled, not kept beside its item');
   assert.match(body, /<a class="bandT signout" href="\/api\/bongos\/auth\/logout">Sign out<\/a>/);
   // a crawler reads every destination without scripting on
-  for (const copy of ['Sky', 'Table', 'Your projects', 'New project', 'About', 'Docs', 'My projects', 'Invitations', 'Account', 'Sign out']) {
+  for (const copy of ['Sky', 'Table', 'Your projects', 'New project', 'About', 'Docs', 'My projects', 'Invitations', 'Connections', 'Account', 'Sign out']) {
     assert.ok(body.includes('>' + copy + '<'), `"${copy}" is only reachable with scripting on`);
   }
   // the menu container is .menuBand: .band is this page's own content sections
@@ -614,7 +615,25 @@ test('the retired gate assets (world/assets/clouds|creatures|plates) are gone
   assert.doesNotMatch(HTML, /\bworld\/assets\//, 'the page links no path under the retired world/assets/ folder');
   assert.doesNotMatch(WORLD, /\bworld\/assets\//, 'world.css references no path under the retired folder');
   // the chrome landing's own plates (task 1003298) live at assets/world/ and are untouched by this cleanup
-  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.jpg')), 'the chrome plate at assets/world/ is untouched (task 1003649 converts it separately)');
+  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.webp')), 'the chrome plate at assets/world/ is untouched by this cleanup');
+});
+
+// Dark mode's first paint fetched the black plates as JPEG at nearly twice the bytes
+// light mode spent on the same sculpture; both halves of each pair are WebP now. The
+// JPEG stays beside the plate as its source, and because a catalog art_url can name it.
+test('the dark plates are WebP; the JPEG each is encoded from stays beside it (task 1003649)', () => {
+  const plates = { '--plate-set': 'r2-chrome-blobs-set', '--plate-bead': 'r2-chrome-blob-one', '--plate-bongos': 'r2-bongos-chrome-b' };
+  for (const [token, file] of Object.entries(plates)) {
+    assert.match(WORLD, new RegExp(`${token}: url\\(/assets/world/${file}\\.webp\\);`), `${token} names the WebP`);
+    const dir = path.join(LANDING, 'assets', 'world');
+    const head = fs.readFileSync(path.join(dir, `${file}.webp`)).subarray(0, 12);
+    assert.equal(head.toString('latin1', 0, 4) + head.toString('latin1', 8, 12), 'RIFFWEBP', `${file}.webp is a WebP file`);
+    const sidecar = JSON.parse(fs.readFileSync(path.join(dir, `${file}.webp.json`), 'utf8'));
+    assert.match(sidecar.encoded, /libwebp/, `${file}.webp.json records the encoding`);
+    assert.ok(sidecar.prompt, `${file}.webp.json carries the prompt`);
+    assert.ok(fs.existsSync(path.join(dir, `${file}.jpg`)) && fs.existsSync(path.join(dir, `${file}.jpg.json`)), `${file}.jpg stays beside its sidecar`);
+  }
+  assert.doesNotMatch(WORLD, /\.jpg\)/, 'world.css requests no JPEG plate');
 });
 
 // ── the CLI download (task 1004257) ─────────────────────────────────────────

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,10 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'd080c7a69a310077';
+// task 1004685 (the living-city prototype): the held-seat nav and the My agents tab,
+// then the reads it shares with the governor pages (window.__hallReads); task 1004713:
+// the seats read from /me's server-resolved positions block.
+const SHELL_SHA = 'd50a4cc5e6c954b5';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/profile_connections_ui.mjs

@@ -36,6 +36,13 @@
 //
 //   5. `seen_at` AND `truncated` NEVER REACH THE SCREEN.
 //
+//   6. YOUR OWN TAB IS THIS PROJECT'S CUT (ADR 0337 D5.4, task 1004279): only
+//      the connections who are also active builders here, read through the
+//      route's `?here=1`, modelled below against an in-memory `builders` table.
+//      The request queues and everyone else live on the hub's /connections, and
+//      the tab links there. It never reads the queues at all, because that read
+//      stamps `seen_at` on rows it would not render.
+//
 // DB-free by construction — no Postgres, no network beyond loopback. The last
 // test proves this file runs in the lane that actually executes on a PR; three
 // tests once declared a lane they were in neither of and asserted nothing for
@@ -84,6 +91,8 @@ const PROV = 9006;  // provisional                → not addressable at all
 const SEC = 9007;   // private AND connected to ME → addressable to ME only
 const NEW = 9008;   // never asked                → the Connect button's home
 const COOL = 9009;  // declined ME 10 days ago    → the swallowed re-ask
+const FAR = 9010;   // connected to ME, builds on another project only → off the own tab
+const GONE = 9011;  // connected to ME, deactivated here               → off the own tab
 const OUTSIDER = 7777; // a second session, to prove "and to nobody else"
 
 // ===========================================================================
@@ -93,6 +102,9 @@ const OUTSIDER = 7777; // a second session, to prove "and to nobody else"
 let accounts = [];
 let edges = [];
 let nextEdgeId = 1;
+// This instance's own builders (core's `builders` table: github_id is text
+// there) — who "builds on this project" for the own tab's `?here=1` cut.
+let builders = new Map();
 
 const acct = (githubId, handle, name, over = {}) => ({
   id: githubId, github_id: String(githubId), github_login: handle, display_name: name,
@@ -127,7 +139,11 @@ function seed() {
     acct(NEW, 'newbie', 'Newbie'),
     acct(COOL, 'cooled', 'Cooled'),
     acct(OUTSIDER, 'outsider', 'Outsider'),
+    acct(FAR, 'faraway', 'Far Away'),
+    acct(GONE, 'gone', 'Gone'),
   ];
+  builders = new Map([ME, ADA, BO, SEC, NEW].map((g) => [String(g), 'active']));
+  builders.set(String(GONE), 'deactivated');
   edges = [];
   nextEdgeId = 1;
   edge(ME, ADA, 'accepted');
@@ -280,12 +296,18 @@ const pool = {
     // ---- my accepted connections -----------------------------------------
     if (/^WITH edge AS \(/.test(sql)) {
       const floor = accountFloor(sql, { axis: 'active' });
+      // The project cut, read OUT OF the statement: the exact clause the domain
+      // exports, or no builders term at all. Any other spelling throws, so a
+      // drifted join can never quietly read as the full list.
+      const here = sql.includes(HERE_SQL);
+      if (!here && /\bbuilders\b/.test(sql)) throw new Error(`fake pool: a builders clause this interpreter cannot read — ${sql}`);
       const gid = params[0]; const limit = Number(params[1]); const offset = Number(params[2]);
       const mine = edges
         .filter((r) => r.status === 'accepted'
           && (String(r.requester_github_id) === String(gid) || String(r.addressee_github_id) === String(gid)))
         .map((r) => ({ id: r.id, gid: String(r.requester_github_id) === String(gid) ? r.addressee_github_id : r.requester_github_id, resolved_at: r.resolved_at }))
         .filter((e) => floor(findAccount(e.gid)))
+        .filter((e) => !here || builders.get(String(e.gid)) === 'active')
         .sort((a, b) => (b.resolved_at || 0) - (a.resolved_at || 0) || b.id - a.id)
         .slice(offset, offset + limit);
       return { rows: mine.map((e) => ({ id: String(e.id), connected_at: iso(e.resolved_at), ...counterparty(e.gid) })), rowCount: mine.length };
@@ -407,6 +429,7 @@ require.cache[moduleApiPath] = {
   },
 };
 const buildConnectionRoutes = require('../modules/platform-identity/routes/connections.js');
+const { HERE_SQL } = require('../modules/platform-identity/connections.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
 const app = express();
@@ -462,7 +485,9 @@ function makeEl() {
 // Boot the real profile-connections.js. `transport` defaults to the live
 // loopback client; a test may pass a canned one for a shape only a hostile or
 // future server could send.
-function boot({ transport } = {}) {
+const HUB = 'https://hub.example';
+
+function boot({ transport, hub = HUB } = {}) {
   const els = new Map();
   const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
   $('#conn-scroll').hidden = true; // the markup ships it hidden
@@ -472,7 +497,7 @@ function boot({ transport } = {}) {
     console: { error() {}, warn() {}, log() {} },
     window: {
       BongosClient: { createClient: () => api },
-      OTB: { $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m) },
+      OTB: { $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m), hubOrigin: () => hub },
       OTBKit: {
         makePager: (prefix, key) => ({ prefix, key, page: 1, perPage: 25 }),
         makeLedger: ({ mount, rowHtml, emptyMsg }) => ({
@@ -737,7 +762,7 @@ test('this page never asks a question about anyone else’s connections', async
   await page.render(profileOf('bo-was', 12), 99);
   assert.ok(asked.length > 0);
   for (const path of asked) {
-    assert.match(path, /^\/api\/bongos\/connections(\/(requests|degree\/[^/]+))?$/,
+    assert.match(path, /^\/api\/bongos\/connections(\/(requests|degree\/[^/]+)|\?here=1)?$/,
       `the section may only read its own scope; ${path} names a subject the session did not`);
     assert.doesNotMatch(path, /\/builders\//, 'a per-builder connections read would be a public list, and there is deliberately no such route');
   }
@@ -845,9 +870,11 @@ test('the mutual count is the length of the names beside it, not a number the re
 test('seen_at never reaches the screen, on either side of a request', async () => {
   reset();
   const stamped = edge(ADA, ME, 'pending', { created_at: Date.now() - DAY, seen_at: Date.now() - 3600000 });
+  // Delete the accepted ADA–ME edge so the pending one is the pair's only row.
+  edges = edges.filter((r) => !(r.status === 'accepted' && r.requester_github_id === ME && r.addressee_github_id === ADA));
   const page = boot();
-  await page.render(profileOf('octo', 7), 7); // own profile
-  assert.match(page.html(), /Ada Lovelace/);
+  await page.render(profileOf('ada', 11), 99); // ADA's profile: her request is the decision there
+  assert.match(page.html(), /They have asked to connect\./);
   assert.doesNotMatch(page.html(), /seen/i);
   assert.doesNotMatch(page.html(), new RegExp(new Date(stamped.seen_at).toISOString().slice(0, 10) + 'T'));
   // and the API never even hands the requester one
@@ -857,45 +884,83 @@ test('seen_at never reaches the screen, on either side of a request', async () =
   assert.ok(!('seen_at' in asRequester.data.outgoing[0]), 'an outgoing row must carry no read receipt');
 });
 
+test('your own tab never reads the request queues, so it never marks a request seen', async () => {
+  reset();
+  const ask = edge(NEW, ME, 'pending', { created_at: Date.now() - DAY });
+  const page = boot();
+  await page.render(profileOf('octo', 7), 7);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.ok(!asked.includes('/api/bongos/connections/requests'),
+    'GET /connections/requests stamps seen_at on what it returns — "delivered" — so a read this tab does not render would mark a request seen that nobody saw');
+  assert.equal(ask.seen_at, null, 'the incoming row is still unseen after the own tab rendered');
+});
+
 // ===========================================================================
 // 7. Your own profile — the list, the queues, and the actions on them
 // ===========================================================================
 
-test('your own profile lists your connections, each 1st by definition, with both request queues', async () => {
+test('your own tab lists only the connections who build on this project, and links to the hub for the rest', async () => {
   reset();
-  edge(ADA, ME, 'pending', { created_at: Date.now() - DAY, note: 'worth comparing notes' });
-  edge(ME, NEW, 'pending', { created_at: Date.now() - DAY });
+  edge(ME, FAR, 'accepted');   // a connection on another project only
+  edge(GONE, ME, 'accepted');  // a connection whose seat here is deactivated
+  edge(NEW, ME, 'pending', { created_at: Date.now() - DAY, note: 'worth comparing notes' });
+  edge(ME, CY, 'pending', { created_at: Date.now() - DAY });
   const page = boot();
   await page.render(profileOf('octo', 7), 7);
   assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.ok(asked.includes('/api/bongos/connections?here=1'), 'the own tab reads the project cut, not the full list');
   const html = page.html();
-  assert.match(html, /2 connections\./, 'the count is the length of the list the viewer was handed');
-  assert.equal((html.match(/conn-degree--1/g) || []).length, 2, 'every accepted connection is 1st by definition');
+  assert.match(html, /2 of your connections build on this project\./, 'the count is the length of the list the viewer was handed');
+  assert.equal((html.match(/conn-degree--1/g) || []).length, 2, 'every listed connection is 1st by definition');
   assert.equal((html.match(/>1st</g) || []).length, 2, '…and it says so — the class alone is not the label');
-  assert.match(html, /1 builder asking to connect/);
-  assert.match(html, /worth comparing notes/);
-  assert.match(html, /1 request you have sent/);
-  assert.match(html, /data-act="withdraw"/);
-  assert.match(html, /data-act="remove"/);
+  assert.match(html, /@ada/);
   // SEC is private, and it is in MY OWN list — own scope floors on consent only.
   assert.match(html, /@sec/);
+  assert.doesNotMatch(html, /@faraway/, 'a connection who does not build here is the hub page’s, not this tab’s');
+  assert.doesNotMatch(html, /@gone/, 'a deactivated seat is not building here');
+  assert.match(html, /data-act="remove"/);
+  // The queues moved to the hub: none drawn, none decidable here.
+  assert.doesNotMatch(html, /asking to connect|you have sent|worth comparing notes/);
+  assert.doesNotMatch(html, /data-act="(accept|decline|withdraw)"/);
+  assert.match(html, /<a class="pbtn" id="conn-hub-link" href="https:\/\/hub\.example\/connections">Open your Connections page<\/a>/);
 });
 
-test('accepting moves the asker into your connections; declining removes it and tells them nothing', async () => {
+test('with no hub origin the own tab draws no link out, and still lists what it has', async () => {
   reset();
-  const ask = edge(ADA, ME, 'pending', { created_at: Date.now() - DAY });
+  const page = boot({ hub: null });
+  await page.render(profileOf('octo', 7), 7);
+  assert.equal(page.$('#conn-scroll').hidden, false);
+  assert.doesNotMatch(page.html(), /conn-hub-link|Connections page/);
+  assert.match(page.html(), /2 of your connections build on this project\./);
+});
+
+test('no connections here yet says so in one line, and the empty ledger says how one arrives', async () => {
+  reset();
+  builders = new Map([[String(ME), 'active']]); // ADA and SEC build elsewhere
   const page = boot();
   await page.render(profileOf('octo', 7), 7);
+  assert.match(page.html(), /None of your connections build on this project yet\./);
+  assert.match(page.html(), /When someone you are connected with joins this project, they show up here\./);
+  assert.match(page.html(), /id="conn-hub-link"/, 'the way to the rest stays, which is when it matters most');
+});
+
+test('accepting and declining are decided on the asker’s profile; a decline tells them nothing', async () => {
+  reset();
+  edge(CY, ME, 'pending', { created_at: Date.now() - DAY });
+  const page = boot();
+  await page.render(profileOf('cy', 13), 99);
+  const ask = edges.find((r) => r.requester_github_id === CY && r.addressee_github_id === ME);
   await click(page, { act: 'accept', id: String(ask.id) });
   assert.ok(page.toasts.includes('Connected.'));
+  assert.match(page.html(), />1st</, 'the label re-reads as 1st once accepted');
 
   reset();
   const spurned = edge(NEW, ME, 'pending', { created_at: Date.now() - DAY });
   const page2 = boot();
-  await page2.render(profileOf('octo', 7), 7);
+  await page2.render(profileOf('newbie', 18), 99);
   await click(page2, { act: 'decline', id: String(spurned.id) });
   assert.ok(page2.toasts.includes('Declined.'));
-  assert.doesNotMatch(page2.html(), /Newbie/, 'the request leaves the inbox');
+  assert.doesNotMatch(page2.html(), /data-act="(accept|decline)"/, 'the decision leaves the page');
   // The requester's own page says nothing about it.
   session = { github_id: NEW, github_login: 'newbie' };
   const theirs = boot();
@@ -910,7 +975,7 @@ test('removing a connection takes it out of the list', async () => {
   const id = /data-act="remove" data-id="(\d+)"/.exec(page.html())[1];
   await click(page, { act: 'remove', id });
   assert.ok(page.toasts.includes('Connection removed.'));
-  assert.match(page.html(), /1 connection\./);
+  assert.match(page.html(), /1 of your connections builds on this project\./);
 });
 
 // ===========================================================================
@@ -935,8 +1000,7 @@ function suggestTransport(suggestions, { onConnect } = {}) {
         if (onConnect) onConnect(opts.body && opts.body.handle);
         return { status: 201, ok: true, data: { status: 'pending' } };
       }
-      if (method === 'GET' && path === '/api/bongos/connections') return { status: 200, ok: true, data: { connections: [], count: 0 } };
-      if (method === 'GET' && path === '/api/bongos/connections/requests') return { status: 200, ok: true, data: { incoming: [], outgoing: [] } };
+      if (method === 'GET' && path === '/api/bongos/connections?here=1') return { status: 200, ok: true, data: { connections: [], count: 0 } };
       if (method === 'GET' && path === '/api/bongos/connections/suggestions') {
         calls.suggestions++;
         return { status: 200, ok: true, data: { suggestions, count: suggestions.length } };
@@ -972,8 +1036,7 @@ test('a failed suggestions read leaves the rest of the own-profile section intac
   const page = boot({
     transport: {
       request: async (_m, path) => {
-        if (path === '/api/bongos/connections') return { status: 200, ok: true, data: { connections: [], count: 0 } };
-        if (path === '/api/bongos/connections/requests') return { status: 200, ok: true, data: { incoming: [], outgoing: [] } };
+        if (path === '/api/bongos/connections?here=1') return { status: 200, ok: true, data: { connections: [], count: 0 } };
         return { status: 500, ok: false, data: null }; // suggestions read fails
       },
     },
@@ -981,7 +1044,7 @@ test('a failed suggestions read leaves the rest of the own-profile section intac
   await page.render(profileOf('octo', 7), 7);
   assert.equal(page.$('#conn-scroll').hidden, false, 'suggestions are additive, never load-bearing for the section itself');
   assert.doesNotMatch(page.html(), /Builders you may know/);
-  assert.match(page.html(), /0 connections\./);
+  assert.match(page.html(), /None of your connections build on this project yet\./);
 });
 
 test('clicking Connect on a suggestion sends the ask by handle and refreshes the section', async () => {

package/tests/projects_hub.mjs

@@ -1944,6 +1944,21 @@ test('the kit proves the picker: a state renders it on the owner\'s feed-carried
   assert.ok(names.some((n) => n.startsWith('manage flows: its planet (task 1003347)')), 'the save probe');
   assert.ok(names.some((n) => n.includes('handed back to the platform')), 'the reset probe');
   assert.ok(names.some((n) => n.includes('its planet at 390')), 'the fold probe');
+  // The reset must undo something (task 1003645): on a fresh page Demo's row carries
+  // no pick and the head already shows the feed's, so a lone reset probe passed
+  // whether or not the reset worked. It now continues the page a pick was saved
+  // on, and that pick is not the template the head falls back to.
+  const resetAt = probes.probes.findIndex((p) => p.name.includes('handed back to the platform'));
+  const reset = probes.probes[resetAt];
+  const picked = probes.probes[resetAt - 1];
+  const headOf = (p) => (p.expect.attr || []).find((a) => a[0] === '#mOrb .worldOrb')?.[2];
+  assert.equal(reset.continue, true, 'the reset runs on the page the pick was saved on');
+  assert.ok(reset.steps.some((s) => s[0] === 'click' && s[1] === '[data-pick-reset]'), 'and presses the reset');
+  assert.ok(picked.steps.some((s) => s[0] === 'click' && s[1] === '[data-pick-save]'), 'the probe before it saves a pick');
+  const feed = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'featured.json'), 'utf8'));
+  const demo = (feed.projects || feed).find((p) => p.origin === 'https://demo.cloudbongos.com');
+  assert.equal(headOf(reset), demo.planet_template, 'the head falls back to the feed’s template');
+  assert.ok(headOf(picked) && headOf(picked) !== headOf(reset), 'the saved pick differs from the fall-back, or the reset proves nothing');
   const saveProbe = probes.probes.find((p) => p.name.startsWith('manage flows: its planet (task 1003347)'));
   assert.ok(saveProbe.expect.text.some((t) => t[1] === 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.'), 'the route\'s no-restart receipt, verbatim');
   const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');

package/tests/render_check.mjs

@@ -25,8 +25,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
   // the account page links the hub's sheet too since task 1004259, the guild page since task 1002301,
-  // and the invitations page since task 1004276
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'guild.states.json', 'invitations.states.json', 'projects.states.json']);
+  // the invitations page since task 1004276, and the connections page since task 1004278
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'connections.states.json', 'guild.states.json', 'invitations.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {

package/tests/ship_broadcast_routing.mjs

@@ -8,12 +8,14 @@
 // PURE decision point — given a shipped task's security flag, it returns the
 // list of { channel, line } pairs the deploy step posts. This test proves:
 //   1. security_sensitive=true  → ONLY the Archon-only #security-ship-feed.
-//   2. security_sensitive=false → the builder #ship-feed only. (#ship-news is
-//      PAUSED — task 1749 / idea 458 — so a ship announces exactly once.)
+//   2. security_sensitive=false → the builder #ship-feed, every ship, and the
+//      owner-facing #ship-news ONLY for a feature or a bug, as the plain
+//      summary with no id (task 1002846 / idea 1000458, the owner's pick: a
+//      kind filter). Any other kind, or none, stays off #ship-news.
 //   3. a falsy summary          → [] (the long-standing no-summary, no-broadcast).
 //   4. the security branch can NEVER return ship_news / ship_feed, for ANY
-//      taskId/summary — the load-bearing safety property (a leak here discloses
-//      an unpatched exploit on a public channel).
+//      taskId/summary/kind — the load-bearing safety property (a leak here
+//      discloses an unpatched exploit on a public channel).
 //
 // Run:  node tests/ship_broadcast_routing.mjs
 
@@ -63,24 +65,63 @@ test('security_sensitive=true NEVER posts to a public channel', () => {
   }
 });
 
-// ---- 2. non-security → #ship-feed only (#ship-news paused, task 1749) ----
+// ---- 2. non-security → #ship-feed always; #ship-news for a feature or a bug ----
 
-test('security_sensitive=false → #ship-feed only (#id prefix); #ship-news paused', () => {
+const ALL_KINDS = ['feature', 'bug', 'infra', 'refactor', 'spike', 'learning-capture', 'cleanup', 'decision', 'blocker-resolution', 'verify'];
+
+test('the news kinds are exactly feature and bug, and every one is a real task kind', () => {
+  const { NEWS_KINDS } = require('../modules/discord/ship-broadcast.js');
+  const kinds = new Set(require('../modules/lifecycle/task-classifier.js').VALID_KINDS);
+  assert.deepEqual([...NEWS_KINDS].sort(), ['bug', 'feature']);
+  for (const k of NEWS_KINDS) assert.ok(kinds.has(k), `${k} is a kind a task can carry`);
+  for (const k of ALL_KINDS) assert.ok(kinds.has(k), `the test's kind list stays real: ${k}`);
+});
+
+test('a feature → the #ship-feed ledger line, then the plain #ship-news headline (no id)', () => {
   const targets = ship.chooseBroadcastTargets({
     securitySensitive: false,
     taskId: 669,
     summary: 'the keeper has a name now',
+    kind: 'feature',
   });
   assert.deepEqual(targets, [
     { channel: 'ship_feed', line: '#669 shipped — the keeper has a name now' },
+    { channel: 'ship_news', line: 'the keeper has a name now' },
   ]);
 });
 
-test('undefined securitySensitive falls through to the public path (#ship-feed only, #ship-news paused)', () => {
-  const targets = ship.chooseBroadcastTargets({
-    taskId: 42,
-    summary: 'routine fix',
-  });
+test('a bug fix is news too', () => {
+  const targets = ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 70, summary: 'the map loads again', kind: 'bug' });
+  assert.deepEqual(targets.map((t) => t.channel), ['ship_feed', 'ship_news']);
+});
+
+test('every other kind stays on #ship-feed alone', () => {
+  for (const kind of ALL_KINDS.filter((k) => k !== 'feature' && k !== 'bug')) {
+    const targets = ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 9, summary: 'tidied the cache', kind });
+    assert.deepEqual(targets, [{ channel: 'ship_feed', line: '#9 shipped — tidied the cache' }], `kind=${kind}`);
+  }
+});
+
+test('a missing or unknown kind posts no headline (a quiet #ship-news is the safe failure)', () => {
+  for (const kind of [undefined, null, '', 'Feature', 'BUG', 'features', 1]) {
+    const targets = ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 42, summary: 'routine fix', kind });
+    assert.deepEqual(targets.map((t) => t.channel), ['ship_feed'], `kind=${String(kind)}`);
+  }
+});
+
+test('undefined securitySensitive falls through to the public path (the kind rule still applies)', () => {
+  assert.deepEqual(ship.chooseBroadcastTargets({ taskId: 42, summary: 'routine fix' }).map((t) => t.channel), ['ship_feed']);
+  assert.deepEqual(ship.chooseBroadcastTargets({ taskId: 42, summary: 'new door', kind: 'feature' }).map((t) => t.channel), ['ship_feed', 'ship_news']);
+});
+
+test('the #ship-news headline never opens with #<id>, so applause can never map it to a task', () => {
+  const news = ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 12, summary: 'search finds builders', kind: 'feature' })
+    .find((t) => t.channel === 'ship_news');
+  assert.doesNotMatch(news.line, /^#\d/);
+});
+
+test('a page approval stays a #ship-feed line, whatever its kind', () => {
+  const targets = ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 31, summary: 'the landing reads better', kind: 'feature', pageTweak: true, pageArtist: 'Ana' });
   assert.deepEqual(targets.map((t) => t.channel), ['ship_feed']);
 });
 
@@ -95,11 +136,11 @@ test('falsy summary → [] (no broadcast), regardless of the security flag', ()
 
 // ---- 4. exhaustive: the security branch is leak-proof across many inputs ----
 
-test('exhaustive: security_sensitive=true never leaks to ship_news/ship_feed for any id/summary', () => {
+test('exhaustive: security_sensitive=true never leaks to ship_news/ship_feed for any id/summary/kind', () => {
   const summaries = ['x', 'a long-ish value summary with spaces', '#641 cross-ref in summary', '🛡️ unicode'];
   for (const taskId of [1, 42, 990, 123456]) {
-    for (const summary of summaries) {
-      const targets = ship.chooseBroadcastTargets({ securitySensitive: true, taskId, summary });
+    for (const summary of summaries) for (const kind of [...ALL_KINDS, undefined]) for (const pageTweak of [false, true]) {
+      const targets = ship.chooseBroadcastTargets({ securitySensitive: true, taskId, summary, kind, pageTweak });
       assert.equal(targets.length, 1, 'security ship posts to exactly one channel');
       assert.equal(targets[0].channel, 'security_ship_feed');
       for (const { channel } of targets) {
@@ -112,7 +153,7 @@ test('exhaustive: security_sensitive=true never leaks to ship_news/ship_feed for
 // ---- purity: same input → deeply-equal output, no shared mutable state ----
 
 test('pure: repeated calls return independent, deeply-equal arrays', () => {
-  const args = { securitySensitive: false, taskId: 5, summary: 's' };
+  const args = { securitySensitive: false, taskId: 5, summary: 's', kind: 'feature' };
   const a = ship.chooseBroadcastTargets(args);
   const b = ship.chooseBroadcastTargets(args);
   assert.deepEqual(a, b);
@@ -121,5 +162,5 @@ test('pure: repeated calls return independent, deeply-equal arrays', () => {
   assert.equal(ship.chooseBroadcastTargets(args)[0].channel, 'ship_feed');
 });
 
-console.log(`\nship broadcast routing (task 990) tests: ${passed} passed, ${failed} failed`);
+console.log(`\nship broadcast routing (task 990, task 1002846) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_broadcast_server.mjs

@@ -56,10 +56,10 @@ const PUBLIC_CHANNELS = new Set(['ship_news', 'ship_feed']);
 
 // ---- 1. postShipBroadcast: routing parity with chooseBroadcastTargets ----
 
-await atest('non-security task → posts #ship-feed only (#ship-news paused, task 1749)', async () => {
+await atest('non-security cleanup → posts #ship-feed only (not news, task 1002846)', async () => {
   const { fn, calls } = fakePoster();
   const res = await shipBroadcast.postShipBroadcast(
-    { id: 669, value_summary: 'the keeper has a name now', security_sensitive: false },
+    { id: 669, value_summary: 'the keeper has a name now', security_sensitive: false, kind: 'cleanup' },
     { postWebhook: fn, log: quietLog }
   );
   assert.deepEqual(calls, [
@@ -69,10 +69,29 @@ await atest('non-security task → posts #ship-feed only (#ship-news paused, tas
   assert.equal(res.skipped, null);
 });
 
-await atest('security task → ONLY #security-ship-feed (never a public channel)', async () => {
+await atest('non-security feature → #ship-feed, then the plain #ship-news headline, read off the row’s kind', async () => {
   const { fn, calls } = fakePoster();
   const res = await shipBroadcast.postShipBroadcast(
-    { id: 990, value_summary: 'patched the credit-theft hole', security_sensitive: true },
+    { id: 670, value_summary: 'builders can find each other', security_sensitive: false, kind: 'feature' },
+    { postWebhook: fn, log: quietLog }
+  );
+  assert.deepEqual(calls, [
+    { channel: 'ship_feed', line: '#670 shipped — builders can find each other' },
+    { channel: 'ship_news', line: 'builders can find each other' },
+  ]);
+  assert.deepEqual(res.posted, ['ship_feed', 'ship_news']);
+});
+
+await atest('a row with no kind posts no headline', async () => {
+  const { fn, calls } = fakePoster();
+  await shipBroadcast.postShipBroadcast({ id: 671, value_summary: 'x', security_sensitive: false }, { postWebhook: fn, log: quietLog });
+  assert.deepEqual(calls.map((c) => c.channel), ['ship_feed']);
+});
+
+await atest('security task → ONLY #security-ship-feed (never a public channel), even a bug', async () => {
+  const { fn, calls } = fakePoster();
+  const res = await shipBroadcast.postShipBroadcast(
+    { id: 990, value_summary: 'patched the credit-theft hole', security_sensitive: true, kind: 'bug' },
     { postWebhook: fn, log: quietLog }
   );
   assert.equal(calls.length, 1);
@@ -112,9 +131,9 @@ await atest('missing task / id → skipped: no_task', async () => {
 });
 
 await atest('best-effort: a throwing webhook never propagates', async () => {
-  // #ship-news is paused (task 1749), so a non-security ship has a single target
-  // (#ship-feed). Prove the per-channel try/catch still swallows a failing post:
-  // a throwing webhook must never propagate, and nothing is recorded posted.
+  // A non-news ship has a single target (#ship-feed). Prove the per-channel
+  // try/catch still swallows a failing post: a throwing webhook must never
+  // propagate, and nothing is recorded posted.
   const calls = [];
   const flaky = async (channel) => {
     calls.push(channel);
@@ -135,6 +154,20 @@ await atest('best-effort: a throwing webhook never propagates', async () => {
   assert.deepEqual(res.posted, [], 'a failed post is not recorded as posted');
 });
 
+await atest('best-effort: a failing #ship-feed does not cost a feature its #ship-news headline', async () => {
+  const calls = [];
+  const flaky = async (channel) => {
+    calls.push(channel);
+    if (channel === 'ship_feed') throw new Error('webhook 500 / not configured');
+  };
+  const res = await shipBroadcast.postShipBroadcast(
+    { id: 43, value_summary: 'a new door', security_sensitive: false, kind: 'feature' },
+    { postWebhook: flaky, log: quietLog }
+  );
+  assert.deepEqual(calls, ['ship_feed', 'ship_news'], 'each target is attempted');
+  assert.deepEqual(res.posted, ['ship_news'], 'only the post that went through is recorded');
+});
+
 // ---- 2. broadcastHandledByServer gate (ship.js) ----
 
 // Set the env BEFORE requiring ship.js is unnecessary — resolveDeployMode +

package/tests/ship_merge_gate.mjs

@@ -214,6 +214,25 @@ test('gateApplies: a vendored instance (no fitness.js on either side) stands the
   }
 });
 
+// task 1004728: a vendored instance keeps an untracked `scripts` link into
+// node_modules/@bongos/core (hidden by .git/info/exclude; grading needs it), so
+// the core's fitness.js is ON DISK while the repo tracks none. The disk check read
+// that as a gated repo and blocked every land on toast. An excluded plain file
+// stands in for the link here: same on-disk shape, and portable to Windows.
+test('gateApplies: an UNTRACKED fitness.js on disk (the vendored scripts link) does not gate the repo', () => {
+  const { dir, baseSha } = gitRepo(false);
+  try {
+    fs.mkdirSync(path.join(dir, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'scripts', 'gds', 'fitness.js'), 'process.exit(1);\n');
+    fs.appendFileSync(path.join(dir, '.git', 'info', 'exclude'), '/scripts\n');
+    assert.equal(gate.gateApplies(dir, baseSha), false);
+    const verdict = gate.gateMergeResult({ repoRoot: dir, baseSha, log: () => {} });
+    assert.deepEqual(verdict, { block: false, reason: 'not-applicable' });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('gateApplies: a merge that DELETES fitness.js from a gated base is still measured (and blocked)', () => {
   const { dir, baseSha } = gitRepo(true);
   try {

package/tests/ui_design_kit.mjs

@@ -43,14 +43,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/guild.states.json', 'modules/public-landing/public/invitations.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/guild.states.json', 'modules/public-landing/public/invitations.states.json', 'modules/public-landing/public/connections.states.json', 'modules/public-landing/public/connections-empty.states.json', 'modules/public-landing/public/connections-inactive.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json', 'modules/public-landing/public/guild.probes.json', 'modules/public-landing/public/invitations.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json', 'modules/public-landing/public/guild.probes.json', 'modules/public-landing/public/invitations.probes.json', 'modules/public-landing/public/connections.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }

package/tests/watch_applications_queue.mjs

@@ -470,6 +470,29 @@ await test('NO profile is not an error — the row renders exactly as it always
   assert.match(row.textContent, /octocat/);
 });
 
+// The handle the vouch carried (ADR 0333 D5, task 1004673): when the hub is down the
+// live profile is null, and the stored handle is what the queue can still call them.
+await test('a vouched row with NO profile names the platform handle its vouch carried', async () => {
+  const h = await boot({ rows: { pending: withProfile(null, { applicant_handle: 'mona-h' }), invited: [], dismissed: [] } });
+  const facts = h.rows()[0].querySelector('.ov-row__facts');
+  assert.match(facts.textContent, /On the platform as @mona-h/);
+  assert.equal(facts.querySelectorAll('a').length, 0, 'plain text: the hub has no person page to point at');
+});
+
+await test('the handle stays off a row that drew its profile, and off an unvouched row', async () => {
+  const drew = await boot({ rows: { pending: withProfile(PUBLIC_PROFILE, { applicant_handle: 'mona-h' }), invited: [], dismissed: [] } });
+  assert.doesNotMatch(drew.rows()[0].textContent, /On the platform as/, 'the live record is shown instead');
+  const unvouched = await boot({ rows: { pending: withProfile(null, { vouched: false, applicant_handle: 'mona-h' }), invited: [], dismissed: [] } });
+  assert.doesNotMatch(unvouched.rows()[0].textContent, /On the platform as/, 'a name anyone could type has no vouched handle');
+});
+
+await test('the vouched handle is escaped', async () => {
+  const h = await boot({ rows: { pending: withProfile(null, { applicant_handle: '<b>x</b>' }), invited: [], dismissed: [] } });
+  const facts = h.rows()[0].querySelector('.ov-row__facts');
+  assert.equal(facts.querySelectorAll('b').length, 0);
+  assert.match(facts.textContent, /@<b>x<\/b>/);
+});
+
 await test('an unrecognised view shape draws nothing rather than guessing', async () => {
   const h = await boot({ rows: { pending: withProfile({ view: 'everything', account: { bio: 'x' } }), invited: [], dismissed: [] } });
   assert.equal(h.rows()[0].querySelector('.ov-row__profile'), null,