@bongos/core 1.21.17 → 1.21.19

package/tests/hall_street_amend.mjs

@@ -0,0 +1,336 @@
+// tests/hall_street_amend.mjs — CHANGE HOW THIS WORKS DRAFTS AN AMENDMENT
+// (task 1004530, goal 1000125).
+//
+// WHAT IT GUARDS. From any building, "change how this works" opens a drafted
+// amendment to that building's row of the who-decides-what table, prefilled
+// with the rule in force and a proposed one as struck and inserted text; the
+// governor picks who and which rule from the vocabulary only, says why, and
+// files it; the street answers. What can go wrong:
+//   * the draft offering a seat or a rule the server does not know (free text),
+//     or a rule that does not fit who decides (as today with a rule, empty with
+//     anything but vacant) — the server would refuse what the governor drafted;
+//   * the struck and inserted words drifting from what the matter card shows the
+//     council (pinned: they ARE the card's change() over the stored amendment);
+//   * a request body the server's own validator refuses, the Charter's draft
+//     going to the rules route (it is the board: /board/items);
+//   * a refusal swallowed, or said as a code instead of words;
+//   * the page filing with no reason, filing twice, or answering nothing.
+//
+// The fixtures are the SERVER'S OWN resolved rows (decision-rules.js), so the
+// draft is tested against the shape the constitution route really serves.
+//
+// Run:  node --test tests/hall_street_amend.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const require = createRequire(import.meta.url);
+const C = require(path.join(PUB, 'street-card.js'));
+const A = require(path.join(PUB, 'street-amend.js'));
+const S = require(path.join(PUB, 'street-draw.js'));
+const DR = require(path.join(ROOT, 'modules/government/decision-rules.js'));
+const { RANK_ORDER } = require(path.join(ROOT, 'modules/government/membership-predicate.js'));
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
+const j = (v) => JSON.parse(JSON.stringify(v));
+
+const BOARD = { membership: 'rank:archon', pass_rule: 'majority', window_minutes: 4320, close_early_on_full_turnout: true };
+function constitution(rows = [], board = BOARD) {
+  return {
+    board,
+    decision_rules: {
+      areas: j(DR.resolveAll(rows, { board })),
+      rules: DR.DECISION_RULES.map((r) => ({ key: r.key, words: r.words })),
+      changed_by: 'a passed amendment only',
+    },
+  };
+}
+const SAT = { area: 'review', decided_by: 'rank:metic+', rule: 'signoff', who: null, set_by_item_id: 12 };
+
+// ── the draft ───────────────────────────────────────────────────────────────
+
+test('the vocabulary is the server\'s: the rank ladder, the seven rules, the nine buildings', () => {
+  assert.deepEqual(A.RANKS, [...RANK_ORDER]);
+  const c = constitution();
+  for (const area of DR.AREA_KEYS) {
+    const d = A.draftFor(area, c);
+    assert.equal(d.ok, true, area);
+    for (const o of d.whoOptions) assert.ok(o.value === 'gate' || o.value === 'nobody' || /^rank:/.test(o.value), `${area}: ${o.value} is a seat, never free text`);
+    for (const o of d.ruleOptions) assert.ok(DR.SITTING_RULE_KEYS.includes(o.value), `${area}: ${o.value}`);
+  }
+});
+
+test('a building decided as today drafts: the board\'s members, by consent, struck and inserted', () => {
+  const d = A.draftFor('review', constitution());
+  assert.equal(d.name, 'Review');
+  assert.deepEqual(d.current, { decided_by: 'gate', rule: null });
+  assert.equal(d.decided_by, 'rank:archon');
+  assert.equal(d.rule, 'consent');
+  assert.deepEqual(d.whoOptions.map((o) => o.value), ['gate', 'rank:archon', 'rank:xenos+', 'rank:thetes+', 'rank:metic+', 'nobody']);
+  assert.equal(d.whoOptions[0].words, 'as today: whoever may mark work as meeting its checks');
+  assert.deepEqual(d.ruleOptions.map((o) => o.value), ['decide', 'first', 'consent', 'majority', 'unanimous', 'signoff']);
+  assert.deepEqual(j(A.change(d)), [{ label: 'Review', struck: 'whoever may mark work as meeting its checks, decides alone', inserted: 'the archon rank, passes unless someone objects' }]);
+});
+
+test('a building already changed drafts its way back to as today', () => {
+  const d = A.draftFor('review', constitution([SAT]));
+  assert.deepEqual(d.current, { decided_by: 'rank:metic+', rule: 'signoff' });
+  assert.equal(d.decided_by, 'gate');
+  assert.equal(d.rule, null);
+  assert.deepEqual(d.ruleOptions, [], 'as today decides alone: there is no rule to pick');
+  assert.deepEqual(j(A.change(d)), [{ label: 'Review', struck: 'metic and above (metic, archon), signed off by someone who did not build it', inserted: 'as it is decided today' }]);
+});
+
+test('the rule follows who: no one is vacant, a sitting keeps a rule that fits, a value outside the vocabulary changes nothing', () => {
+  let d = A.draftFor('people', constitution());
+  d = A.pick(d, 'who', 'nobody');
+  assert.equal(d.rule, 'vacant');
+  assert.deepEqual(j(A.change(d))[0].inserted, 'no one yet');
+  d = A.pick(d, 'who', 'rank:metic+');
+  assert.ok(DR.SITTING_RULE_KEYS.includes(d.rule), 'a sitting gets a sitting rule back');
+  d = A.pick(d, 'rule', 'unanimous');
+  assert.equal(d.rule, 'unanimous');
+  assert.equal(A.pick(d, 'who', 'rank:everyone'), d, 'not a seat on offer');
+  assert.equal(A.pick(d, 'rule', 'vacant'), d, 'vacant is not a sitting rule');
+  assert.equal(A.pick(d, 'rule', 'whatever'), d);
+  d = A.pick(d, 'who', 'gate');
+  assert.equal(A.changed(d), false, 'back to as today is no change');
+  assert.deepEqual(A.change(d), []);
+  assert.match(A.check(d), /how it works today/);
+});
+
+test('the request is the one the server\'s validator accepts, and the card reads it back word for word', () => {
+  for (const [area, who, rule] of [['review', 'rank:archon', 'consent'], ['treasury', 'rank:metic+', 'majority'], ['people', 'nobody', null], ['rules', 'rank:xenos+', 'signoff']]) {
+    let d = A.draftFor(area, constitution());
+    d = A.pick(d, 'who', who);
+    if (rule) d = A.pick(d, 'rule', rule);
+    assert.equal(A.request(d), null, 'no reason, no request');
+    assert.match(A.check(d), /Say why/);
+    d = A.pick(d, 'reason', '  Three pieces of work are waiting.  ');
+    const req = A.request(d);
+    assert.equal(req.method, 'POST');
+    assert.equal(req.url, '/api/bongos/government/board/decision-rules');
+    assert.equal(req.body.rationale_md, 'Three pieces of work are waiting.');
+    const v = DR.validateDecisionRulesProposal(req.body.rules);
+    assert.equal(v.ok, true, `${area}: ${v.reason}`);
+    assert.equal(DR.changesAnything(v.rules, []), true, 'a change the server will not refuse as no_change');
+    // the card the council votes on, over the amendment as the server stores it
+    const stored = { subject_type: 'constitutional_amendment', subject: { kind: 'decision_rules', proposed: { decision_rules: j(v.rules) } } };
+    const docket = { buildings: [{ key: area, decision: constitution().decision_rules.areas.find((r) => r.area === area) }] };
+    assert.deepEqual(j(C.change(stored, docket, { board: BOARD }).rows), j(A.change(d)), `${area}: drafted words = voted words`);
+  }
+});
+
+test('the Charter is the board: its draft is a constitution amendment of members and pass rule, through /board/items', () => {
+  let d = A.draftFor('charter', constitution());
+  assert.equal(d.charter, true);
+  assert.ok(!d.whoOptions.some((o) => o.value === 'gate' || o.value === 'nobody'), 'the charter is never as-today or empty');
+  assert.deepEqual(d.ruleOptions.map((o) => o.value), ['first', 'consent', 'majority', 'unanimous'], 'the board\'s four pass rules');
+  assert.equal(d.rule, 'consent');
+  assert.deepEqual(j(A.change(d)), j(C.change({ subject: { kind: 'constitution', proposed: { pass_rule: 'consent' } } }, null, { board: { pass_rule: 'majority' } }).rows));
+  assert.equal(j(A.change(d))[0].label, 'how it passes');
+  d = A.pick(A.pick(d, 'who', 'rank:metic+'), 'reason', 'More of us should sit.');
+  const req = A.request(d);
+  assert.equal(req.url, '/api/bongos/government/board/items');
+  assert.equal(req.body.subject_type, 'constitutional_amendment');
+  assert.deepEqual(Object.keys(req.body.proposal).sort(), ['close_early_on_full_turnout', 'membership', 'pass_rule', 'window_minutes'], 'a constitution is filed whole, with no field the validator refuses');
+  assert.deepEqual(req.body.proposal, { membership: 'rank:metic+', pass_rule: 'consent', window_minutes: 4320, close_early_on_full_turnout: true });
+  assert.equal(j(A.change(d)).length, 2, 'who sits, and how it passes');
+});
+
+test('a constitution that could not be read drafts nothing, and says so', () => {
+  for (const c of [null, {}, { board: BOARD }, { board: BOARD, decision_rules: null }, { board: BOARD, decision_rules: { areas: [], rules: [] } }]) {
+    const d = A.draftFor('review', c);
+    assert.equal(d.ok, false);
+    assert.equal(A.request(d), null);
+    assert.match(A.check(d), /could not be read/);
+  }
+});
+
+test('the server\'s refusal is said plainly, never as a code', () => {
+  const env = (code, details) => ({ error: { code, message: code, details } });
+  assert.match(A.refusal(403, env('forbidden')), /not yours to do/);
+  assert.match(A.refusal(401, env('unauthorized')), /Sign in/);
+  assert.match(A.refusal(409, env('no_change', { reason: 'every building named is already decided this way' })), /already is how it works/);
+  assert.match(A.refusal(400, env('invalid_decision_rules', { reason: 'unknown_rank', rank_key: 'council' })), /no such rank/);
+  assert.equal(A.refusal(400, env('invalid_decision_rules', { reason: 'too_many_rows' })), 'The server refused it: too many rows.');
+  assert.equal(A.refusal(409, env('proposer_would_lose_their_seat', { what_this_means: 'You would no longer sit on the board.' })), 'You would no longer sit on the board.');
+  assert.equal(A.refusal(0, {}), 'It could not be done just now.');
+  for (const s of [A.refusal(400, env('invalid_decision_rules', { reason: 'bad_rule' })), A.refusal(403, env('forbidden'))]) assert.doesNotMatch(s, /_/);
+});
+
+test('the model is pure', () => {
+  const src = read('street-amend.js').replace(/^\s*\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /document\.|fetch\(|Date\.now|Math\.random|innerHTML/);
+  const d = A.draftFor('review', constitution());
+  assert.deepEqual(j(A.draftFor('review', constitution())), j(d));
+  A.pick(d, 'who', 'gate');
+  assert.equal(d.decided_by, 'rank:archon', 'a pick returns a new draft');
+});
+
+// ── the page ────────────────────────────────────────────────────────────────
+
+test('the markup: the draft lives under the button, hidden, and the model loads before the page', () => {
+  const html = read('street.html').replace(/<!--[\s\S]*?-->/g, '');
+  assert.match(html, /id="insideAmend" aria-expanded="false" aria-controls="insideDraft"/);
+  assert.match(html, /<div class="inside-draft" id="insideDraft" hidden><\/div>/);
+  const order = ['street-card.js', 'street-amend.js', 'street.js'].map((f) => html.indexOf(`/builders/${f}?`));
+  assert.ok(order[0] > 0 && order[0] < order[1] && order[1] < order[2], 'card, then the draft model, then the page');
+  const css = read('street.css').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.ok(css.includes('.inside-draft[hidden] { display: none; }'));
+  assert.match(css, /@media \(max-width: 899px\) \{\s*\.inside-draft__picks \{ grid-template-columns: 1fr; \}/, 'narrow: the picks stack');
+  assert.doesNotMatch(css.slice(css.indexOf('.inside-draft')), /#[0-9a-f]{3,8}\b/i, 'tokens only');
+  assert.doesNotMatch(read('street.js'), /not built yet/);
+});
+
+function fakeDom() {
+  const byId = new Map();
+  const focused = { el: null };
+  const mk = (tag) => ({
+    tagName: tag, attrs: {}, kids: [], className: '', listeners: {}, _text: '', hidden: false, value: undefined,
+    style: { setProperty(k, v) { this[k] = v; } },
+    clientWidth: 1440, clientHeight: 708, offsetLeft: 0, scrollLeft: 0, parentNode: null,
+    get children() { const a = this.kids.slice(); a[Symbol.isConcatSpreadable] = false; return a; },
+    get firstChild() { return this.kids[0] || null; },
+    setAttribute(k, v) { this.attrs[k] = String(v); if (k === 'id') byId.set(String(v), this); },
+    getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; },
+    appendChild(c) { this.kids.push(c); c.parentNode = this; return c; },
+    removeChild(c) { this.kids = this.kids.filter((x) => x !== c); return c; },
+    addEventListener(t, fn) { (this.listeners[t] = this.listeners[t] || []).push(fn); },
+    fire(t, e = {}) { return (this.listeners[t] || []).map((fn) => fn({ type: t, preventDefault() {}, ...e })); },
+    focus() { focused.el = this; },
+    set textContent(v) { this._text = String(v); this.kids = []; },
+    get textContent() { return this._text; },
+    get innerHTML() { throw new Error('no innerHTML'); },
+    set innerHTML(v) { throw new Error('no innerHTML'); },
+  });
+  const html = read('street.html').replace(/<!--[\s\S]*?-->/g, '');
+  for (const id of [...html.matchAll(/id="([A-Za-z]+)"/g)].map((m) => m[1])) {
+    const el = mk('x');
+    el.setAttribute('id', id);
+    const tag = new RegExp(`<[^>]*\\bid="${id}"[^>]*>`).exec(html);
+    if (tag && /\shidden(?=[\s>])/.test(tag[0])) el.hidden = true;
+  }
+  const document = { documentElement: mk('html'), getElementById: (id) => byId.get(id) || null, createElement: (t) => mk(t), createElementNS: (_ns, t) => mk(t) };
+  return { document, byId, focused };
+}
+const all = (el) => [el, ...el.kids.flatMap(all)];
+const textOf = (el) => all(el).map((n) => n._text).filter(Boolean).join(' | ');
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+async function bootPage({ hash = '#building=review', cons = constitution(), answer = () => ({ status: 201, body: { ok: true, item: { id: 77 }, amendment: { id: 5 } } }) } = {}) {
+  const { document, byId, focused } = fakeDom();
+  const gets = [], posts = [], history = [];
+  const location = { hash };
+  const window = {
+    innerWidth: 1440, innerHeight: 900, location,
+    localStorage: { getItem: () => null, setItem() {} },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    addEventListener() {},
+    history: { pushState(_s, _t, url) { history.push(url); location.hash = ''; } },
+  };
+  const feeds = {
+    '/api/bongos/government/docket': { viewer: { id: '95' }, counts: { needs: 0, moving: 0, settled: 0 }, line: '', matters: [], buildings: S.CIVIC_KEYS.map((key) => ({ key, name: key, matter_ids: [] })), sources: [], readings: [] },
+    '/api/bongos/goals': { goals: [] },
+    '/api/bongos/goals/rollups': { rollups: [] },
+    '/api/bongos/government/constitution': cons,
+  };
+  const fetch = (url, opts = {}) => {
+    if (opts.method === 'POST') {
+      posts.push({ url, body: JSON.parse(opts.body) });
+      const a = answer(url);
+      return Promise.resolve({ ok: a.status < 300, status: a.status, json: async () => a.body });
+    }
+    gets.push(url);
+    const body = feeds[url];
+    return Promise.resolve(body == null ? { ok: false, status: 500, json: async () => ({}) } : { ok: true, status: 200, json: async () => body });
+  };
+  const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN, isFinite, Map, setTimeout, clearTimeout });
+  ctx.globalThis = ctx;
+  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-amend.js', 'street.js']) vm.runInContext(read(f), ctx);
+  await window.GovStreetPage.ready;
+  await tick();
+  return { window, byId, focused, gets, posts, history };
+}
+
+test('change how this works opens the drafted amendment: struck, inserted, who, how, why', async () => {
+  const p = await bootPage();
+  const box = p.byId.get('insideDraft');
+  assert.equal(box.hidden, true);
+  await p.byId.get('insideAmend').fire('click')[0];
+  assert.ok(p.gets.includes('/api/bongos/government/constitution'), 'the rule in force is read fresh');
+  assert.equal(box.hidden, false);
+  assert.equal(p.byId.get('insideAmend').attrs['aria-expanded'], 'true');
+  const del = all(box).find((n) => n.tagName === 'del'), ins = all(box).find((n) => n.tagName === 'ins');
+  assert.equal(del.textContent, 'whoever may mark work as meeting its checks, decides alone');
+  assert.equal(ins.textContent, 'the archon rank, passes unless someone objects');
+  assert.equal(p.focused.el, p.byId.get('insideDraftWho'), 'focus lands on who decides');
+  assert.equal(p.byId.get('insideDraftWho').kids.length, 6);
+  assert.equal(p.byId.get('insideDraftRule').value, 'consent');
+  // a pick redraws the words and keeps focus where it was
+  const who = p.byId.get('insideDraftWho');
+  who.value = 'nobody';
+  who.fire('change');
+  assert.equal(all(box).find((n) => n.tagName === 'ins').textContent, 'no one yet');
+  assert.ok(!all(box).some((n) => n.attrs.id === 'insideDraftRule'), 'an empty building has no rule to pick');
+  assert.match(textOf(box), /nothing is decided until someone holds it/);
+  assert.equal(p.focused.el.attrs.id, 'insideDraftWho');
+  // a feed landing mid-sentence leaves the draft alone
+  const before = p.byId.get('insideDraftWhy');
+  before.value = 'half a thought';
+  before.fire('input');
+  await p.window.GovStreetPage.load();
+  assert.equal(p.byId.get('insideDraftWhy'), before, 'the same textarea, not a fresh one');
+  // not now closes it and gives focus back to the button
+  all(box).find((n) => n.tagName === 'button' && n._text === 'not now').fire('click');
+  assert.equal(box.hidden, true);
+  assert.equal(p.byId.get('insideAmend').attrs['aria-expanded'], 'false');
+  assert.equal(p.focused.el, p.byId.get('insideAmend'));
+});
+
+test('filing: no reason is refused in place; a filed amendment goes to the Charter, once, and the street answers', async () => {
+  const p = await bootPage();
+  await p.byId.get('insideAmend').fire('click')[0];
+  await p.byId.get('insideDraftFile').fire('click')[0];
+  assert.equal(p.posts.length, 0, 'nothing is sent without a reason');
+  assert.match(p.byId.get('insideDraftError').textContent, /Say why/);
+  assert.equal(p.byId.get('insideDraftError').attrs.role, 'alert');
+  assert.equal(p.focused.el, p.byId.get('insideDraftWhy'));
+  const why = p.byId.get('insideDraftWhy');
+  why.value = 'Three pieces of finished work are waiting.';
+  const first = p.byId.get('insideDraftFile').fire('click')[0];
+  await p.byId.get('insideDraftFile').fire('click')[0];
+  await first;
+  assert.equal(p.posts.length, 1, 'one click files once');
+  assert.deepEqual(p.posts[0], { url: '/api/bongos/government/board/decision-rules', body: { rules: [{ area: 'review', decided_by: 'rank:archon', rule: 'consent' }], rationale_md: 'Three pieces of finished work are waiting.' } });
+  assert.equal(p.byId.get('streetToast').hidden, false);
+  assert.equal(p.byId.get('streetToast').textContent, 'Filed. Your amendment to Review is on the Charter for the council to vote on.');
+  assert.deepEqual(p.history, ['/builders/street'], 'back to the street, where the Charter pin appears');
+  assert.equal(p.byId.get('streetInside').hidden, true);
+});
+
+test('a refusal from the server is said in the draft, and the draft stays to be changed', async () => {
+  const p = await bootPage({ answer: () => ({ status: 403, body: { error: { code: 'forbidden', message: 'missing permission board.item.open' } } }) });
+  await p.byId.get('insideAmend').fire('click')[0];
+  p.byId.get('insideDraftWhy').value = 'Because.';
+  await p.byId.get('insideDraftFile').fire('click')[0];
+  assert.equal(p.posts.length, 1);
+  assert.match(p.byId.get('insideDraftError').textContent, /not yours to do/);
+  assert.equal(p.byId.get('insideDraft').hidden, false);
+  assert.equal(p.history.length, 0, 'still in the building');
+  assert.equal(p.byId.get('streetToast').hidden, true);
+});
+
+test('a constitution that cannot be read says so where the draft would be', async () => {
+  const p = await bootPage({ cons: null });
+  await p.byId.get('insideAmend').fire('click')[0];
+  assert.equal(p.byId.get('insideDraft').hidden, true);
+  assert.equal(p.byId.get('insideAmendNote').hidden, false);
+  assert.match(p.byId.get('insideAmendNote').textContent, /could not be read/);
+});

package/tests/hall_street_inside.mjs

@@ -475,8 +475,10 @@ test('picking a floor moves the SAME lift node and re-enters the chosen block; d
   assert.equal(p.byId.get('insideDrawers').children[1].attrs['aria-pressed'], 'true');
   assert.equal(p.byId.get('insideAmendNote').hidden, true);
   p.byId.get('insideAmend').fire('click');
-  assert.equal(p.byId.get('insideAmendNote').hidden, false, 'change how this works says it is not built yet, rather than nothing');
-  assert.match(p.byId.get('insideAmendNote').textContent, /not built yet/);
+  await new Promise((r) => setTimeout(r, 0));
+  // the draft itself is tests/hall_street_amend.mjs (task 1004530); with no constitution to read it says so, never nothing
+  assert.equal(p.byId.get('insideAmendNote').hidden, false, 'change how this works answers, rather than nothing');
+  assert.match(p.byId.get('insideAmendNote').textContent, /could not be read/);
 });
 
 test('a table row opens the short card; Escape gives focus back to the row; back to the street returns to the door', async () => {

package/tests/rank_tier_single_source.mjs

@@ -124,6 +124,11 @@ const STATIC_LADDER_FILES = [
   // match the canonical order or the example teaches a ladder that does not
   // exist.
   'modules/hall-ui/public/government.js',
+  // task 1004530: the street's drafted amendment offers the rank ladder as the
+  // seats a building can be handed to (rank:<key>+). Browser code, so a mirror;
+  // tests/hall_street_amend.mjs pins GovAmend.RANKS equal to the server's
+  // membership-predicate RANK_ORDER.
+  'modules/hall-ui/public/street-amend.js',
   // task 1002487: the pure agent-definition validator applies the ADR 0043
   // sub-Metic floor to an agent's declared scope, so it needs the ladder to
   // compare against. It is one of the "dependency-free" cases this array exists

package/tests/wizard_draft_resume.mjs

@@ -101,57 +101,86 @@ test('a draft already at step 1 is unchanged, and an out-of-range step is not re
   }
 });
 
-// ── slice 2 · syncHome's control over the way back ────────────────────────────────
+// ── slice 2 · no "Allow repo access" step: the token is fetched, not asked for (task 1004555) ──
+// Owner, 2026-10-02: "I don't want to see the old button at all." Every hub sign-in asks
+// for repo access (ADR 0364) and GitHub answers at once for anyone who approved it, so a
+// missing token is fetched by ONE automatic round-trip. The slices below are syncHome (what
+// shows) and ensureRepoAccess (the probe and the hop), run under a DOM + fetch stub.
 const SYNC_RE = /function syncHome\(\) \{[\s\S]*?\n {4}\}/;
 const syncSlice = (HUB.match(SYNC_RE) || [null])[0];
+const HOP_RE = /var HOP_KEY = 'cb-repo-hop';[\s\S]*?function hopForRepoAccess\(\) \{[\s\S]*?\n {4}\}/;
+const hopSlice = (HUB.match(HOP_RE) || [null])[0];
+const PROBE_RE = /function ensureRepoAccess\(\) \{[\s\S]*?\n {4}\}/;
+const probeSlice = (HUB.match(PROBE_RE) || [null])[0];
 
-test('the syncHome slice is still findable', () => {
+test('the syncHome, hop and probe slices are still findable', () => {
   assert.ok(syncSlice, 'syncHome() was not found in projects.html');
-  assert.match(syncSlice, /ghManualBack/, 'syncHome governs the way-back control');
+  assert.ok(hopSlice, 'hopForRepoAccess() was not found in projects.html');
+  assert.ok(probeSlice, 'ensureRepoAccess() was not found in projects.html');
+});
+
+test('the page carries no "Allow repo access" control at all', () => {
+  assert.doesNotMatch(HUB, /Allow repo access/);
+  assert.doesNotMatch(HUB, /id="ghConnect/);
+  assert.doesNotMatch(HUB, /need-connect/, 'no state is left that would ask for it');
 });
 
 function runSync(repoAccess) {
   const els = {};
   // Elements start HIDDEN so that "shown" is only ever the result of syncHome setting it.
-  // With a `hidden: false` default, a control syncHome never mentions reads as visible and
-  // the assertion below would pass against the unfixed page.
-  const el = (id) => (els[id] ||= {
-    id, hidden: true, textContent: '', _on: false,
-    classList: { toggle(_c, v) { els[id]._on = !!v; } },
-  });
+  const el = (id) => (els[id] ||= { id, hidden: true, textContent: '' });
   const sandbox = {
-    repoAccess,
-    state: { mode: 'greenfield' },
-    $: el,
-    isManualHome: () => repoAccess === 'manual' || repoAccess === 'unavailable',
+    repoAccess, state: { mode: 'greenfield' }, $: el,
+    isManualHome: () => repoAccess === 'unavailable',
     initAdoptPicker() {}, syncFresh() {},
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(syncSlice + '\nsyncHome();', sandbox);
-  return { connectShown: el('ghConnect')._on, manualShown: !el('manualHome').hidden, backShown: !el('ghManualBack').hidden };
+  return { noteShown: !el('ghNoAccess').hidden, manualShown: !el('manualHome').hidden, freshShown: !el('ghFresh').hidden };
+}
+
+test('without access the manual fields show with one plain line; with access they do not', () => {
+  assert.deepEqual(runSync('unavailable'), { noteShown: true, manualShown: true, freshShown: false });
+  assert.deepEqual(runSync(true), { noteShown: false, manualShown: false, freshShown: true });
+});
+
+async function runProbe({ status, hopped = false }) {
+  const store = new Map(hopped ? [['cb-repo-hop', '1']] : []);
+  const assigned = [];
+  let saves = 0;
+  const sandbox = {
+    API: '/api/bongos', ghProbed: false, repoAccess: null, repoList: [],
+    sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, v), removeItem: (k) => store.delete(k) },
+    window: { location: { assign: (u) => assigned.push(u) } },
+    saveDraft() { saves += 1; }, syncHome() {},
+    fetch: () => Promise.resolve({ status, json: () => Promise.resolve({ repos: [] }) }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(hopSlice + '\n' + probeSlice + '\nvar done = ensureRepoAccess();', sandbox);
+  await new Promise((r) => setTimeout(r, 0));
+  await new Promise((r) => setTimeout(r, 0));
+  return { assigned, saves, repoAccess: vm.runInContext('repoAccess', sandbox), mark: store.get('cb-repo-hop') || null };
 }
 
-test('choosing manual leaves a way back to the connect offer', () => {
-  const manual = runSync('manual');
-  assert.equal(manual.manualShown, true, 'the manual fields are up');
-  assert.equal(manual.connectShown, false, 'the connect box is down — that is what made it a trap');
-  assert.equal(manual.backShown, true, 'and the way back is offered');
+test('a missing token is fetched by one automatic GitHub round-trip, back to the wizard, draft saved first', async () => {
+  const r = await runProbe({ status: 403 });
+  assert.deepEqual(r.assigned, ['/api/bongos/auth/web/start?return=/projects%3Fview%3Dnew&repos=1']);
+  assert.equal(r.saves, 1, 'the draft is saved before the page leaves');
+  assert.equal(r.mark, '1', 'the hop is marked for this tab');
 });
 
-test('a FORCED fallback offers no way back, because connecting cannot help', () => {
-  // 'unavailable' means the server could not store a token. Offering "use my GitHub
-  // repositories instead" there would send the visitor through a round-trip that lands
-  // them right back here — an offer that cannot be honoured is worse than none.
-  const forced = runSync('unavailable');
-  assert.equal(forced.manualShown, true);
-  assert.equal(forced.backShown, false);
+test('a second miss after the hop falls back to the manual fields instead of looping', async () => {
+  const r = await runProbe({ status: 403, hopped: true });
+  assert.deepEqual(r.assigned, [], 'no second round-trip');
+  assert.equal(r.repoAccess, 'unavailable');
 });
 
-test('while the connect offer is up, the way back is not', () => {
-  const need = runSync('need-connect');
-  assert.equal(need.connectShown, true);
-  assert.equal(need.backShown, false, 'no second, redundant control beside the button itself');
+test('access found clears the mark, so a later expiry may hop again', async () => {
+  const r = await runProbe({ status: 200, hopped: true });
+  assert.equal(r.repoAccess, true);
+  assert.equal(r.mark, null);
 });
 
 // ── slice 3 · why this task's original team-shape claim was wrong ─────────────────

package/tests/wizard_six_screens.mjs

@@ -102,7 +102,7 @@ test('nothing the old steps could do is lost: their controls are moved whole int
     const r = (p.match(new RegExp(`<div class="setRow" data-row="${row}">[\\s\\S]*?\\n {16}</div>\\n`)) || [''])[0];
     for (const id of ids) assert.match(r, new RegExp(`id="${id}"`), `${row} row hosts #${id}`);
   };
-  has('code', ['physExisting', 'c-green', 'c-adopt', 'adoptNote', 'ghConnect', 'ghAdopt', 'ghFresh', 'manualHome', 'h-home']);
+  has('code', ['physExisting', 'c-green', 'c-adopt', 'adoptNote', 'ghNoAccess', 'ghAdopt', 'ghFresh', 'manualHome', 'h-home']);
   has('address', ['f-slug', 'addrConfirm', 'addrCustom', 'f-domain', 'f-noaddr']);
   has('app', ['appOpts', 'renderLater', 'renderSetup', 'f-renderKey', 'renderWs', 'renderSvc', 'renderNew']);
   has('extras', ['modQ', 'modCards', 'modWhy', 'modCoreNote']);