@bongos/core 1.21.153 → 1.21.155

package/release-notes.json

@@ -9940,5 +9940,21 @@
       "id": "1004766",
       "text": "When a project's server can't talk to GitHub, the land-status check now says which step failed and what GitHub answered, instead of a bare error."
     }
+  ],
+  "1.21.154": [
+    {
+      "id": "1003800",
+      "text": "In the module store, a buyer can now sort by the score that matters to them, like reliability or tests, so the module strongest at that comes first."
+    }
+  ],
+  "1.21.155": [
+    {
+      "id": "1004769",
+      "text": "The person who built something can now sign off its UAT themselves, not only the project owner. The old rule is paused, not deleted, so it can come back with one change."
+    },
+    {
+      "id": "1004768",
+      "text": "A page rewrite can now include a long paragraph. Before, any paragraph over 400 characters was dropped from the site's text list, so the privacy page's changes could not be applied."
+    }
   ]
 }

package/scripts/gds/copy-inventory.js

@@ -66,7 +66,11 @@ const SURFACES = [
 // Attributes whose value is COPY a person reads (not wiring). The matchers are
 // built ONCE — the first cut re-created all seven per markup literal.
 const COPY_ATTRS = ['title', 'aria-label', 'placeholder', 'alt', 'data-page-title', 'aria-description'];
-const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,400})"`, 'gi') }));
+// The longest string the registry lists. A page tweak may rewrite a paragraph
+// past the old 400, and the applier then could not find its own words in the
+// registry it regenerates (task 1004768, the privacy page's round).
+const MAX_COPY_LEN = 2000;
+const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,${MAX_COPY_LEN}})"`, 'gi') }));
 
 // What this tool knowingly does not see. Printed in the report — an inventory that
 // implies completeness it does not have is worse than a short one.
@@ -125,7 +129,7 @@ function lineAt(starts, index) {
 // by platform (task 1004545 — a 396-char run was 403 under CRLF and vanished).
 function looksLikeCopy(raw) {
   const s = String(raw).replace(/\r\n/g, '\n').trim();
-  if (s.length < 4 || s.length > 400) return false;
+  if (s.length < 4 || s.length > MAX_COPY_LEN) return false;
   if (!/[A-Za-z]{2}/.test(s)) return false;               // needs actual letters
   if (!/\s/.test(s) && !/[.!?]$/.test(s)) return false;   // one bare word is a token
   if (/^[/.#]/.test(s)) return false;                     // paths, selectors
@@ -561,7 +565,7 @@ if (require.main === module) {
 }
 
 module.exports = {
-  SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
+  SURFACES, COPY_ATTRS, BLIND_SPOTS, MAX_COPY_LEN, REGISTRY_REL, REPORT_REL,
   cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
   buildRegistry, renderReport, write, matchesGenerated,
 };

package/src/bongos/module-listing.js

@@ -92,6 +92,40 @@ function readParts(signals = [], { floor = QUALITY_FLOOR } = {}) {
   return { parts, strengths, weaknesses, unmeasured };
 }
 
+// ---------------------------------------------------------------------------
+// Sort by the part a buyer cares about (task 1003800, owner decision 2026-10-22)
+// ---------------------------------------------------------------------------
+//
+// A module strong at what a buyer needs should come first for THAT buyer. Nothing
+// records what a category is "for", and a hidden per-category weighting would break
+// the score an author can check (ADR 0343 D3), so the owner chose: the buyer picks
+// the part. The rule, in a sentence an author can check:
+//
+//   modules with a score for the part come first, highest first; a tie goes to the
+//   higher overall score, then the key. A module with no score for the part goes
+//   last, in key order: a missing part is never a zero, and never a first place.
+//
+// Only `listed` is sorted. A "New" version is never ranked (owner decision,
+// 2026-10-01), so `new` keeps key order whatever the buyer picks. Today this runs
+// over the whole store; once approved sub-categories exist (task 1004355) the same
+// rule orders each one (ADR 0342 D2).
+const SORT_PARTS = PARTS.map(({ part, title }) => ({ part, title }));
+
+// `entries` carry `parts` as readParts builds them. Returns a new array. Pure.
+function sortByPart(entries, part) {
+  const scoreOf = (e) => (e.parts && e.parts[part] ? e.parts[part].score : null);
+  return [...entries].sort((a, b) => {
+    const sa = scoreOf(a);
+    const sb = scoreOf(b);
+    if (sa == null || sb == null) {
+      if (sa != null) return -1;
+      if (sb != null) return 1;
+      return a.key.localeCompare(b.key);
+    }
+    return (sb - sa) || ((b.overall ?? -1) - (a.overall ?? -1)) || a.key.localeCompare(b.key);
+  });
+}
+
 // The newest version row per module key, in semver order (a version that does not
 // parse is skipped, as latestVersions does in module-store.js).
 function newestPerModule(rows) {
@@ -106,12 +140,13 @@ function newestPerModule(rows) {
   return [...out.values()];
 }
 
-// The catalog: { floor, listed: [...], new: [...] }, each entry
+// The catalog: { floor, sort, sort_parts, listed: [...], new: [...] }, each entry
 // { key, title, version, published_at, overall, is_new, parts, strengths, weaknesses,
 // unmeasured } (the last four from readParts). Excluded versions are left
 // out entirely: a module below the bar is not listed at all. Both lists are in key
-// order; ranking is a separate task (1003808) and does not happen here.
-async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
+// order unless `sort` names a part, which orders `listed` by sortByPart; ranking
+// is a separate task (1003808) and does not happen here.
+async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
   const pool = db || require('./pool').pool;
   const { rows: versions } = await pool.query(
     `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
@@ -142,7 +177,7 @@ async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
       signals.get(k).push(s);
     }
   }
-  const out = { floor, listed: [], new: [] };
+  const out = { floor, sort: sort || null, sort_parts: SORT_PARTS, listed: [], new: [] };
   for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
@@ -153,7 +188,8 @@ async function listCatalog({ db, floor = QUALITY_FLOOR } = {}) {
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });
   }
+  if (sort) out.listed = sortByPart(out.listed, sort);
   return out;
 }
 
-module.exports = { QUALITY_FLOOR, STRONG_AT, placeVersion, readParts, listCatalog };
+module.exports = { QUALITY_FLOOR, STRONG_AT, SORT_PARTS, placeVersion, readParts, sortByPart, listCatalog };

package/src/bongos/routes/modules.js

@@ -110,7 +110,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
-const { listCatalog } = require('../module-listing');
+const { listCatalog, SORT_PARTS } = require('../module-listing');
 
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
@@ -733,12 +733,20 @@ module.exports = function buildModulesRouter() {
   // listed module's newest version, if it passed the Security gate and scores at or
   // above the floor, or under "new" if it has no real-world data yet. Below the bar
   // is not listed at all. The floor is fixed in module-listing.js and returned here.
+  // `?sort=<part>` orders the listed modules by the part a buyer cares about
+  // (task 1003800, sortByPart); the parts it accepts come back as sort_parts.
   //
   // rank: any-builder — a read of public store metadata, like /store/modules/latest:
   // no entitlement taken, nothing changed.
   router.get('/store/modules', auth.requireBuilder,
-    asyncHandler('GET /store/modules', async (_req, res) => {
-      const listing = await listCatalog();
+    asyncHandler('GET /store/modules', async (req, res) => {
+      const raw = req.query && req.query.sort;
+      const sort = typeof raw === 'string' && raw ? raw : null;
+      if (sort && !SORT_PARTS.some((p) => p.part === sort)) {
+        const names = SORT_PARTS.map((p) => `${p.title} (${p.part})`).join(', ');
+        return res.fail('bad_request', { status: 400, message: `The store can be sorted by one part of the score: ${names}.` });
+      }
+      const listing = await listCatalog({ sort });
       res.set('Cache-Control', 'no-store');
       res.json(listing);
     }));

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.153'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.155'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/copy_inventory.mjs

@@ -103,15 +103,18 @@ test('stripEmbedded keeps line numbers truthful', () => {
 // Windows regen dropped a row CI kept and redded "the committed artifacts match".
 // The fixture rebuilds both halves: a tag inside a comment, and a run sized to
 // straddle the cap.
-// Eight 45-char lines under a 28-char head: 396 chars on LF, 404 on CRLF.
-const NEAR_CAP_LINES = Array.from({ length: 8 }, () => `   ${'word '.repeat(8)}s.`);
+// 45-char lines under a 28-char head, as many as fit under the cap on LF; each
+// CRLF adds one, which pushes it over. Sized from MAX_COPY_LEN (task 1004768).
+const NEAR_CAP_HEAD = 'A real sentence on the page,';
+const NEAR_CAP_LINE = `   ${'word '.repeat(8)}s.`;
+const NEAR_CAP_LINES = Array.from({ length: Math.floor((inv.MAX_COPY_LEN - NEAR_CAP_HEAD.length) / (NEAR_CAP_LINE.length + 1)) }, () => NEAR_CAP_LINE);
 const EOL_FIXTURE = [
   '<!doctype html>',
   '<!-- Author note: a building is a door (an <a>) to its interior.',
   '     The template is street.css, the <style> on the tokens.',
   '-->',
   '<style>.x { color: red; }</style>',
-  '<p>A real sentence on the page,',
+  `<p>${NEAR_CAP_HEAD}`,
   ...NEAR_CAP_LINES.slice(0, -1),
   `${NEAR_CAP_LINES.at(-1)}</p>`,
   '<p title="A tooltip a person reads">Second real line.</p>',
@@ -123,13 +126,26 @@ test('LF and CRLF checkouts extract identical rows (task 1004545)', () => {
   const strip = (rows) => rows.map(({ text, line, origin }) => ({ text, line, origin }));
   assert.deepEqual(strip(crlf), strip(lf), 'the registry must not depend on the checkout\'s line endings');
   const run = EOL_FIXTURE.slice(EOL_FIXTURE.indexOf('A real'), EOL_FIXTURE.indexOf('</p>'));
-  assert.ok(run.length <= 400 && run.replace(/\n/g, '\r\n').length > 400, 'the fixture must straddle the cap, or this test proves nothing');
+  assert.ok(run.length <= inv.MAX_COPY_LEN && run.replace(/\n/g, '\r\n').length > inv.MAX_COPY_LEN, 'the fixture must straddle the cap, or this test proves nothing');
   // The multi-line sentence sits under the cap only when CRLF counts as one
   // character — so this is the case that reds if the length rule regresses.
   assert.ok(lf.some((r) => r.text.startsWith('A real sentence on the page')), 'a multi-line run under the cap is copy on LF');
   assert.ok(crlf.some((r) => r.text.startsWith('A real sentence on the page')), 'and the same run is copy on CRLF');
 });
 
+// The privacy page's round rewrote one paragraph past 400 characters, and the
+// registry dropped it, so the applier could not find its own words (task 1004768).
+test('a long paragraph a page tweak writes is still listed', () => {
+  const para = `We keep only what we need to run your account. ${'Nothing else is stored or sold, and you can ask for it to be removed. '.repeat(14)}`.trim();
+  assert.ok(para.length > 1000 && para.length <= inv.MAX_COPY_LEN, 'the fixture must sit well past the old 400 cap');
+  const rows = inv.fromHtml({ source: `<p>${para}</p>\n<p title="${para}">x y</p>`, rel: 'p.html' });
+  assert.equal(rows.filter((r) => r.text === para).length, 2, 'listed as text and as an attribute');
+  const at = (n) => `${'ab '.repeat(n)}`.slice(0, n - 1) + '.';
+  assert.equal(at(inv.MAX_COPY_LEN).length, inv.MAX_COPY_LEN);
+  assert.equal(inv.looksLikeCopy(at(inv.MAX_COPY_LEN)), true, 'exactly at the cap is listed');
+  assert.equal(inv.looksLikeCopy(at(inv.MAX_COPY_LEN + 1)), false, 'one past the cap is refused');
+});
+
 test('HTML comments are never copy, and a tag named inside one swallows nothing', () => {
   const rows = inv.fromHtml({ source: EOL_FIXTURE, rel: 'p.html' });
   const texts = rows.map((r) => r.text);
@@ -140,7 +156,7 @@ test('HTML comments are never copy, and a tag named inside one swallows nothing'
   assert.ok(texts.includes('Second real line.'));
   assert.ok(texts.includes('A tooltip a person reads'));
   const real = rows.find((r) => r.text === 'Second real line.');
-  assert.equal(real.line, 15, 'a stripped comment must not shift the lines after it');
+  assert.equal(real.line, 7 + NEAR_CAP_LINES.length, 'a stripped comment must not shift the lines after it');
   // A span still addresses the file's own characters (copy-apply writes through it).
   assert.equal(EOL_FIXTURE.slice(real.start, real.end), 'Second real line.');
 });

package/tests/criterion_uat.mjs

@@ -29,6 +29,8 @@ import { makeRunner } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
+// The shipper rule is paused in production (owner, 2026-10-22); prove it still works.
+process.env.UAT_SELF_SIGNOFF = 'off';
 const uat = require('../modules/lifecycle/criterion-uat.js');
 const uatDb = require('../modules/lifecycle/criterion-uat-db.js');
 const doneWhen = require('../modules/lifecycle/done-when.js');
@@ -115,6 +117,23 @@ await test('LADDER: whoever shipped linked work is refused — ids compare as st
   assert.equal(code({ signerId: '8' }), 'signer_shipped_this_work');
 });
 
+await test('PAUSE (task 1004769): at the production default a shipper is let through, and only the shipper rung moves', () => {
+  const modPath = require.resolve('../modules/lifecycle/criterion-uat.js');
+  delete process.env.UAT_SELF_SIGNOFF;
+  delete require.cache[modPath];
+  try {
+    const paused = require(modPath);
+    const pcode = (over) => { const r = paused.signoffRefusal({ ...base, ...over }); return r && r.code; };
+    assert.equal(pcode({ signerId: 7 }), null);
+    assert.equal(pcode({ signerId: '8' }), null);
+    assert.equal(pcode({ signerId: 7, recording: null }), 'uat_recording_required');
+  } finally {
+    process.env.UAT_SELF_SIGNOFF = 'off';
+    delete require.cache[modPath];
+    require(modPath);
+  }
+});
+
 await test('LADDER: the project owner may sign off work they shipped (solo projects)', () => {
   assert.equal(code({ signerId: 3, shipperIds: ['3'] }), null);
 });

package/tests/hall_catalog_world.mjs

@@ -94,7 +94,7 @@ test('modules: the store group reads strengths and weaknesses off the server row
   const html = read('modules.html');
   assert.match(html, /<div class="ov-group" id="store-group" hidden>/, 'the store group is hidden until the store answers');
   assert.match(html, /<ul class="ov-rows" id="store-grid"><\/ul>/);
-  assert.match(js, /api\.request\('GET', `\$\{API\}\/store\/modules`\)/, 'it reads GET /store/modules');
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/store\/modules\$\{q\}`\)/, 'it reads GET /store/modules');
   assert.match(js, /<span class="ov-fact">strong at \$\{partsList\(strong\)\}<\/span>/, 'a strength is a plain fact');
   assert.match(js, /<span class="fact-pill fact-pill--warn">weak at \$\{partsList\(weak\)\}<\/span>/, 'a weakness is the warn pill');
   assert.match(js, /not measured yet/, 'a part with no data is named, never counted as weak');
@@ -106,6 +106,18 @@ test('modules: the store group reads strengths and weaknesses off the server row
   assert.notDeepEqual(two[0].strengths.map((s) => s.part), two[1].strengths.map((s) => s.part), '…that are strong at different things');
 });
 
+test('modules: the buyer sorts the store by the part that matters to them (task 1003800)', () => {
+  const js = read('modules.js');
+  const html = read('modules.html');
+  assert.match(html, /<select id="store-sort"><option value="">Name<\/option><\/select>/, 'the menu starts at name order');
+  assert.match(js, /\?sort=\$\{encodeURIComponent\(storeSort\)\}/, 'the server orders the list; the page asks for a part');
+  assert.match(js, /fillStoreSort\(body\.sort_parts\)/, 'the parts on the menu are the server\'s list');
+  assert.doesNotMatch(decomment(js), /\.sort\(\(a, b\)/, 'the page does not re-sort the store rows itself');
+  assert.match(js, /not measured yet<\/span>/, 'a row with no score for the sorted part says so, not a zero');
+  const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'store__modules.json'), 'utf8'));
+  assert.deepEqual(fixture.sort_parts.map((p) => p.part), ['tests', 'install', 'reliability', 'tester_feedback', 'docs'], 'the harness carries the menu');
+});
+
 test('modules: the kit filter bar carries the search and a state lens, and the empty state is the kit\'s', () => {
   const js = read('modules.js');
   assert.match(js, /kit\.makeFilterBar\(\{/, 'the bar is the kit\'s');

package/tests/module_store_listing.mjs

@@ -53,7 +53,7 @@ const poolPath = require.resolve('../src/bongos/pool.js');
 require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
 
 const buildModulesRouter = require('../src/bongos/routes/modules.js');
-const { QUALITY_FLOOR, placeVersion } = require('../src/bongos/module-listing.js');
+const { QUALITY_FLOOR, SORT_PARTS, placeVersion, sortByPart } = require('../src/bongos/module-listing.js');
 
 function handlerFor(router, method, p) {
   const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
@@ -163,7 +163,83 @@ test('GET /store/modules: an empty store answers empty lists and the floor', asy
   state.modules = {}; state.versions = []; state.scores = [];
   const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
   const res = await invoke(handle, {});
-  assert.deepEqual(res.body, { floor: 50, listed: [], new: [] });
+  assert.deepEqual(res.body, { floor: 50, sort: null, sort_parts: SORT_PARTS, listed: [], new: [] });
+});
+
+// ---------------------------------------------------------------------------
+// sort by the part a buyer cares about (task 1003800, owner decision 2026-10-22)
+// ---------------------------------------------------------------------------
+
+const entry = (key, overall, partScores) => ({
+  key, overall,
+  parts: Object.fromEntries(Object.entries(partScores).map(([p, s]) => [p, { outcome: s == null ? 'no_data' : 'scored', score: s, sample_size: null }])),
+});
+
+test('sortByPart: highest first for the chosen part; a tie goes to the overall score, then the key', () => {
+  const out = sortByPart([
+    entry('b-mod', 70, { reliability: 90 }),
+    entry('a-mod', 70, { reliability: 90 }),
+    entry('steady', 60, { reliability: 95 }),
+    entry('higher', 80, { reliability: 90 }),
+  ], 'reliability');
+  assert.deepEqual(out.map((e) => e.key), ['steady', 'higher', 'a-mod', 'b-mod']);
+});
+
+test('sortByPart: a module with no score for the part goes last, never first, and the input is untouched', () => {
+  const input = [entry('z-unmeasured', 99, { reliability: null }), entry('low', 55, { reliability: 10 }), entry('a-missing', 99, {})];
+  const out = sortByPart(input, 'reliability');
+  assert.deepEqual(out.map((e) => e.key), ['low', 'a-missing', 'z-unmeasured']);
+  assert.equal(input[0].key, 'z-unmeasured', 'a new array; the listing it came from keeps its order');
+});
+
+test('SORT_PARTS: every part a buyer compares, Security not among them', () => {
+  assert.deepEqual(SORT_PARTS.map((p) => p.part), ['tests', 'install', 'reliability', 'tester_feedback', 'docs']);
+});
+
+test('GET /store/modules?sort=: orders the listed modules by the part, leaves New in key order', async () => {
+  state.modules = {
+    tested: { status: 'listed', title: 'Tested' }, steady: { status: 'listed', title: 'Steady' },
+    'b-new': { status: 'listed', title: 'B new' }, 'a-new': { status: 'listed', title: 'A new' },
+  };
+  state.versions = [
+    { id: 21, module_key: 'tested', version: '1.0.0', published_at: 't' },
+    { id: 22, module_key: 'steady', version: '1.0.0', published_at: 't' },
+    { id: 23, module_key: 'b-new', version: '1.0.0', published_at: 't' },
+    { id: 24, module_key: 'a-new', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 21, version_id: 21, computed_at: 1, ...score({ overall: 74 }) },
+    { id: 22, version_id: 22, computed_at: 1, ...score({ overall: 74 }) },
+    { id: 23, version_id: 23, computed_at: 1, ...score({ is_new: true }) },
+    { id: 24, version_id: 24, computed_at: 1, ...score({ is_new: true }) },
+  ];
+  state.signals = [
+    { id: 21, version_id: 21, measured_at: 1, ...sig('tests', 96) },
+    { id: 22, version_id: 21, measured_at: 1, ...sig('reliability', 52) },
+    { id: 23, version_id: 22, measured_at: 1, ...sig('tests', 58) },
+    { id: 24, version_id: 22, measured_at: 1, ...sig('reliability', 91) },
+    { id: 25, version_id: 23, measured_at: 1, ...sig('reliability', 99) },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const byRel = await invoke(handle, { query: { sort: 'reliability' } });
+  assert.equal(byRel.body.sort, 'reliability');
+  assert.deepEqual(byRel.body.listed.map((m) => m.key), ['steady', 'tested'], 'the buyer who cares about reliability sees Steady first');
+  assert.deepEqual(byRel.body.new.map((m) => m.key), ['a-new', 'b-new'], 'New is never ranked, whatever the buyer picks');
+  const byTests = await invoke(handle, { query: { sort: 'tests' } });
+  assert.deepEqual(byTests.body.listed.map((m) => m.key), ['tested', 'steady']);
+  const plain = await invoke(handle, { query: {} });
+  assert.equal(plain.body.sort, null);
+  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is key order, as before');
+  state.signals = [];
+});
+
+test('GET /store/modules?sort=: a part it does not know is refused, Security included', async () => {
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  for (const sort of ['security', 'price', 'overall']) {
+    const res = await invoke(handle, { query: { sort } });
+    assert.equal(res.statusCode, 400, `${sort} is not a part to sort by`);
+    assert.match(res.body.message, /Tests \(tests\), Clean installs \(install\), Reliability \(reliability\), Tester feedback \(tester_feedback\), How-to \(docs\)/, 'the refusal names each part as a person says it, with the value to send');
+  }
 });
 
 // ---------------------------------------------------------------------------