@bongos/core 1.21.175 → 1.21.177

package/tests/grader.mjs

@@ -6,7 +6,7 @@
 //
 // The v2 subagent itself is a real-network call, so the tests stop at the
 // validator + prompt-builder boundary; the network-touching end-to-end check
-// lives in scripts/gds/grade-smoke.js and is run manually.
+// lives in scripts/bongos/grade-smoke.js and is run manually.
 //
 // Run:  node tests/grader.mjs
 
@@ -815,20 +815,20 @@ test('buildContextBundle REFUSES a truncated prefix that shows none of the chang
   const head = '// preamble\n'.repeat(2_000);            // ~24k chars, all before the change
   const big = `${head}function formatPublishFailure(data, status, branch) {\n  return 'x';\n}\n`;
   const diff = [
-    'diff --git a/scripts/gds/ship.js b/scripts/gds/ship.js',
-    '--- a/scripts/gds/ship.js',
-    '+++ b/scripts/gds/ship.js',
+    'diff --git a/scripts/bongos/ship.js b/scripts/bongos/ship.js',
+    '--- a/scripts/bongos/ship.js',
+    '+++ b/scripts/bongos/ship.js',
     '@@ -1226,0 +1226,3 @@',
     '+function formatPublishFailure(data, status, branch) {',
     "+  return 'x';",
     '+}',
   ].join('\n');
   const bundle = grader.buildContextBundle({
-    changedFiles: ['scripts/gds/ship.js'], cwd: '/r', diff,
+    changedFiles: ['scripts/bongos/ship.js'], cwd: '/r', diff,
     fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
   });
   assert.deepEqual(bundle.files, [], 'a prefix with none of the change is not bundled');
-  assert.deepEqual(bundle.skipped, ['scripts/gds/ship.js'], 'it lands in skipped, where the prompt tells the worker to Read it');
+  assert.deepEqual(bundle.skipped, ['scripts/bongos/ship.js'], 'it lands in skipped, where the prompt tells the worker to Read it');
 });
 
 test('buildContextBundle still bundles a truncated file when the change IS visible in the prefix (task 1002905)', () => {
@@ -1656,7 +1656,7 @@ await testAsync('v4 runWorker (#465): one retry only — if the retry also error
   assert.equal(r.error, 'SUBAGENT_NONZERO_EXIT');
 });
 
-// --- #467: per-worker timeouts + transient-error set + audit-exports core ---
+// --- #467: per-worker timeouts + transient-error set ---
 
 test('v4 #467 / task 1002580: every gating/advisory worker gets the 360s heavy-tier budget', () => {
   // task 1002580: Hacker/Efficiency were 240s on the (false) assumption they are
@@ -1689,22 +1689,6 @@ test('v4 #465/#467: TRANSIENT_WORKER_ERRORS covers infra noise but NOT timeout',
   assert.ok(!t.has('PROMPT_TOO_LONG'), 'a window overflow is deterministic, never retried (task 1003318)');
 });
 
-test('v4 #467: audit-exports classifyExports — consumed / test-only / DEAD', () => {
-  const auditExports = require('../scripts/gds/audit-exports.js');
-  const target = '/repo/src/bongos/grader.js';
-  const corpus = {
-    [target]: 'function usedSym(){} function testSym(){} function deadSym(){}', // self — excluded
-    '/repo/src/server.js': 'grader.usedSym()',          // consumer in src/
-    '/repo/tests/grader.mjs': 'grader.testSym === 1',   // consumer only in tests/
-    // deadSym appears nowhere outside the defining file
-  };
-  const out = auditExports.classifyExports(target, ['usedSym', 'testSym', 'deadSym'], corpus);
-  const by = Object.fromEntries(out.map((r) => [r.name, r.status]));
-  assert.equal(by.usedSym, 'consumed');
-  assert.equal(by.testSym, 'test-only');
-  assert.equal(by.deadSym, 'DEAD');
-});
-
 test('v4 WORKERS.resolvePanel: unknown kind throws (typo catches don\'t silently skip)', () => {
   assert.throws(() => grader.WORKERS.resolvePanel(['narc', 'nopenotreal']), /unknown worker kind/i);
 });
@@ -2135,7 +2119,7 @@ test('isTrivialDiff: a logic-path file (src/) → false even when small', () =>
 test('isTrivialDiff: scripts/ and tests/ are logic paths → false', () => {
   assert.equal(
     grader.isTrivialDiff({
-      changedFiles: ['scripts/gds/smoke-write.sh'],
+      changedFiles: ['scripts/bongos/smoke-write.sh'],
       diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
     }),
     false

package/tests/grader_generated_provenance.mjs

@@ -120,13 +120,13 @@ test('the session-log ship shape implicates gen-session-index.js, and every othe
   ]);
 });
 
-test('a docs-only regeneration implicates gen-api-docs.js for each doc it owns that changed', () => {
-  const g = prov.generatorsInDiff(['docs/api/openapi.json', 'docs/api-reference.md']);
+test('a docs-only regeneration implicates gen-api-docs.js for the doc it owns', () => {
+  const g = prov.generatorsInDiff(['docs/routes-permissions.md']);
   assert.equal(g.length, 1);
   assert.equal(g[0].script, 'gen-api-docs.js');
-  assert.deepEqual(g[0].owned.map((o) => o.file).sort(), ['docs/api-reference.md', 'docs/api/openapi.json']);
-  // routes-permissions.md did NOT change, so it is not claimed.
-  assert.ok(!g[0].owned.some((o) => o.file === 'docs/routes-permissions.md'));
+  assert.deepEqual(g[0].owned.map((o) => o.file), ['docs/routes-permissions.md']);
+  // task 1004866: the gitignored spec + reference are claimed by nobody (never in a diff).
+  assert.deepEqual(prov.generatorsInDiff(['docs/api/openapi.json', 'docs/api-reference.md']), []);
 });
 
 test('THE DELIBERATE TRADE: a route change + its regenerated docs gets NO claim', () => {
@@ -136,7 +136,7 @@ test('THE DELIBERATE TRADE: a route change + its regenerated docs gets NO claim'
   // about a generator's whole require-chain, which the panel rightly rejected as
   // unsound. The case this feature exists for — the session-log ship — is
   // docs-only and stays covered.
-  assert.deepEqual(prov.generatorsInDiff(['modules/lifecycle/routes/tasks.js', 'docs/api/openapi.json']), []);
+  assert.deepEqual(prov.generatorsInDiff(['modules/lifecycle/routes/tasks.js', 'docs/routes-permissions.md']), []);
 });
 
 // ---- 3. verify: pass ⇒ verified, fail ⇒ unverified ----
@@ -197,11 +197,11 @@ test('a clean diff runs NO generator at all', () => {
 
 test('one generator failing does not taint another that passed', () => {
   const m = prov.verifyGeneratedProvenance({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md'],
     run: (script) => { if (script === 'gen-api-docs.js') throw new Error('stale'); },
   });
   assert.deepEqual([...new Set(m.verified.map((v) => v.file))], ['CLAUDE.md']);
-  assert.deepEqual(m.unverified.map((v) => v.file), ['docs/api/openapi.json']);
+  assert.deepEqual(m.unverified.map((v) => v.file), ['docs/routes-permissions.md']);
 });
 
 // ---- 4/5. the prompt section ----
@@ -225,7 +225,7 @@ test('the verified section states the load-bearing facts', () => {
 });
 
 test('a whole-file generator is described as whole-file, not as a fence', () => {
-  const m = prov.verifyGeneratedProvenance({ changedFiles: ['docs/api/openapi.json'], run: () => {} });
+  const m = prov.verifyGeneratedProvenance({ changedFiles: ['docs/routes-permissions.md'], run: () => {} });
   const s = prov.provenanceSection(m);
   assert.match(s, /ENTIRE FILE is output of `gen-api-docs\.js`/);
   assert.doesNotMatch(s, /region inside the/, 'no fence language for a whole-file artifact');
@@ -251,11 +251,11 @@ test('the async verifier is what the grade path uses, and it does not block', as
   // spawns, so prompt construction only READS the finished manifest.
   const calls = [];
   const m = await prov.verifyGeneratedProvenanceAsync({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md'],
     run: async (script, flag) => { calls.push(`${script} ${flag}`); },
   });
   assert.deepEqual(calls.sort(), ['gen-api-docs.js --check', 'gen-interaction-posture.js --check', 'gen-session-index.js --check-block']);
-  assert.deepEqual([...new Set(m.verified.map((v) => v.file))].sort(), ['CLAUDE.md', 'docs/api/openapi.json']);
+  assert.deepEqual([...new Set(m.verified.map((v) => v.file))].sort(), ['CLAUDE.md', 'docs/routes-permissions.md']);
 });
 
 test('the async verifier runs NOTHING for a diff with no generated file', async () => {
@@ -353,8 +353,8 @@ test('verification runs ONLY for a diff that introduces no executable file', ()
   // line: if nothing in the diff can RUN, running a generator cannot execute
   // anything the diff added — no require-chain to reason about.
   assert.ok(!prov.diffCarriesExecutable(['CLAUDE.md', 'docs/session-logs/x.md']), 'the motivating case stays eligible');
-  assert.ok(!prov.diffCarriesExecutable(['docs/api/openapi.json', 'docs/api-reference.md']));
-  assert.ok(prov.diffCarriesExecutable(['scripts/gds/gen-repo-map.js']), 'the generator itself');
+  assert.ok(!prov.diffCarriesExecutable(['docs/routes-permissions.md', 'docs/api-reference.md']));
+  assert.ok(prov.diffCarriesExecutable(['scripts/bongos/gen-repo-map.js']), 'the generator itself');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'modules/lifecycle/db.js']), 'anything a generator might require');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'deploy.sh']), 'shell too');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'tests/x.mjs']));
@@ -392,7 +392,7 @@ test('the implicated checks run concurrently, not in series', async () => {
   let inFlight = 0;
   let maxInFlight = 0;
   await prov.verifyGeneratedProvenanceAsync({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json', 'docs/file-map.md'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md', 'docs/file-map.md'],
     run: async () => {
       inFlight += 1;
       maxInFlight = Math.max(maxInFlight, inFlight);

package/tests/grader_no_artifact.mjs

@@ -27,7 +27,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const na = require(path.join(ROOT, 'modules', 'grading', 'grader-no-artifact.js'));
 const grader = require(path.join(ROOT, 'modules', 'grading', 'grader.js'));
-const steps = require(path.join(ROOT, 'scripts', 'gds', 'ship-grade-steps.js'));
+const steps = require(path.join(ROOT, 'scripts', 'bongos', 'ship-grade-steps.js'));
 
 const TASK = {
   id: '1004011',

package/tests/grader_prompt_fencing.mjs

@@ -16,7 +16,7 @@
 //   3. An injection string in the diff lands INSIDE the fence (it is presented
 //      as data under review, not as a bare instruction in the trusted frame).
 //
-// Pure (no DB / network) so it runs in `node scripts/gds/run-unit-tests.js`.
+// Pure (no DB / network) so it runs in `node scripts/bongos/run-unit-tests.js`.
 //
 // Run:  node tests/grader_prompt_fencing.mjs
 

package/tests/grader_quality_window_overflow.mjs

@@ -29,7 +29,7 @@ const require = createRequire(import.meta.url);
 const rubric = require('../modules/grading/grader-rubric.json');
 const grader = require('../modules/grading/grader.js');
 const workersMod = require('../modules/grading/grader-workers/index.js');
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 
 const { aggregatePanel, validateAndScore, workerModelFor } = grader;
 const { runWorker, TRANSIENT_WORKER_ERRORS } = workersMod;

package/tests/grader_reader_lens.mjs

@@ -168,7 +168,7 @@ test('scope keys off the ONE existing predicate, not a second copy', () => {
   // The at-ship lens and the after-the-fact artist review must never disagree
   // about what they cover. Widening COPY_VISUAL_MODULES must widen both at once,
   // which it only does while there is one predicate.
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'ship-grade.js'), 'utf8');
   assert.match(src, /hasCopyOrVisualWork/, 'the caller asks lifecycle for the answer');
   assert.match(src, /panelFor\(\{ copyBearing \}\)/, 'and passes it down');
   // RECURSIVE. A readdirSync of modules/grading alone skips grader-workers/,
@@ -286,14 +286,14 @@ test('the per-ship artist review is gone, and the lens keeps its scope predicate
 });
 
 test('the copy lens is scoped by the files the work changed', () => {
-  const shipSrc = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  const shipSrc = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'ship-grade.js'), 'utf8');
   assert.match(shipSrc, /hasCopyOrVisualWork/);
   // Task 1004201: the grader hands the predicate the files the work changed, so
   // an unlabelled UI ship gets the lens at grade time.
   assert.match(shipSrc, /hasCopyOrVisualWork\(task, changedFiles\)/, 'the grader passes its own diff');
   const unlabelled = { module_key: null, discipline: 'engineer' };
   assert.equal(hasCopyOrVisualWork(unlabelled, ['modules/hall-ui/public/goal-forest-lib.js']), true);
-  assert.equal(hasCopyOrVisualWork(unlabelled, ['modules/hall-ui/module.json', 'scripts/gds/claim.js']), false);
+  assert.equal(hasCopyOrVisualWork(unlabelled, ['modules/hall-ui/module.json', 'scripts/bongos/claim.js']), false);
 });
 
 // ---- 8. COST ---------------------------------------------------------------

package/tests/grader_regrade_delta.mjs

@@ -18,7 +18,7 @@ const require = createRequire(import.meta.url);
 const { buildWorkerPrompt, REGRADE_DELTA_POLICY } = require('../modules/grading/grader-workers/worker-prompt.js');
 const { FENCE_DELIM } = require('../modules/grading/grader-workers/fence.js');
 const workers = require('../modules/grading/grader-workers/index.js');
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 
 let passed = 0;
 let failed = 0;

package/tests/grader_unbacked_score.mjs

@@ -27,8 +27,8 @@ const grader = require('../modules/grading/grader.js');
 const { aggregatePanel, validateAndScore, serverSideGuards, THRESHOLD, FALLTHROUGH_CONFIDENCE } = grader;
 const { unbackedLowScores, UNBACKED_SCORE_DOWNGRADE, failResult } = require('../modules/grading/grader-workers/worker-verdict.js');
 const { runWorker, quality, narc, hacker, efficiency } = require('../modules/grading/grader-workers/index.js');
-const { buildGradePayload, formatGradeOutcome } = require('../scripts/gds/ship-grade-steps.js');
-const { CARDS } = require('../scripts/gds/plain-cards.js');
+const { buildGradePayload, formatGradeOutcome } = require('../scripts/bongos/ship-grade-steps.js');
+const { CARDS } = require('../scripts/bongos/plain-cards.js');
 
 let passed = 0;
 let failed = 0;

package/tests/hall_acclaim_vote_control.mjs

@@ -0,0 +1,113 @@
+// tests/hall_acclaim_vote_control.mjs — Home's peer-acclaim feed votes through
+// THE shared list vote control (task 1004833, follow-up to task 1004727).
+//
+// What it pins:
+//   * the feed's row renders OTBVote.taskHtml, pre-painted from the feed's own
+//     net_votes / my_vote (no extra read), and a viewer below the vote floor
+//     sees the net alone;
+//   * a vote cast through the REAL control raises 'otb-vote', and the feed's
+//     REAL handler (sliced out of builders.js, never retyped) writes it into the
+//     held, paged rows, so flipping pages does not paint a stale tally;
+//   * the feed's old vote markup, click handler and CSS are gone.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8').replace(/\r\n/g, '\n');
+const builders = read('builders.js');
+
+// A small DOM: enough for the control's cast() and event dispatch.
+function el(attrs = {}) {
+  const node = {
+    attrs: { ...attrs }, children: [], parent: null, textContent: '', disabled: false, listeners: {},
+    classList: {
+      set: new Set(),
+      add(...c) { c.forEach((x) => this.set.add(x)); },
+      remove(...c) { c.forEach((x) => this.set.delete(x)); },
+      toggle(c, on) { if (on) this.set.add(c); else this.set.delete(c); },
+      contains(c) { return this.set.has(c); },
+    },
+    getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; },
+    setAttribute(k, v) { this.attrs[k] = String(v); },
+    hasAttribute(k) { return k in this.attrs; },
+    querySelector(sel) { return this.querySelectorAll(sel)[0] || null; },
+    querySelectorAll(sel) {
+      const name = sel.slice(1, -1);
+      const out = [];
+      const walk = (n) => { for (const c of n.children) { if (c.hasAttribute(name)) out.push(c); walk(c); } };
+      walk(this);
+      return out;
+    },
+    closest(sel) {
+      const name = sel.slice(1, -1);
+      for (let n = this; n; n = n.parent) if (n.hasAttribute(name)) return n;
+      return null;
+    },
+    append(c) { c.parent = this; this.children.push(c); return c; },
+    addEventListener(type, fn) { (this.listeners[type] = this.listeners[type] || []).push(fn); },
+    dispatchEvent(ev) {
+      for (let n = this; n; n = ev.bubbles ? n.parent : null) (n.listeners[ev.type] || []).forEach((fn) => fn(ev));
+      return true;
+    },
+  };
+  return node;
+}
+
+class CustomEvent { constructor(type, init = {}) { this.type = type; this.bubbles = !!init.bubbles; this.detail = init.detail; } }
+
+function bootControl(fetchImpl) {
+  const ctx = { console, fetch: fetchImpl, CustomEvent };
+  ctx.window = ctx;
+  vm.createContext(ctx);
+  vm.runInContext(read('vote-control.js'), ctx);
+  return ctx.OTBVote;
+}
+
+// The feed's real handler, sliced from builders.js and run over a held list.
+function feedHandler(tasks) {
+  const start = builders.indexOf('function onAcclaimVote(');
+  assert.ok(start > 0, 'builders.js defines onAcclaimVote');
+  const end = builders.indexOf('\n  }\n', start) + 4;
+  const ctx = { acclaimState: { tasks } };
+  vm.createContext(ctx);
+  vm.runInContext(`${builders.slice(start, end)}\nthis.onAcclaimVote = onAcclaimVote;`, ctx);
+  return ctx;
+}
+
+test('the feed row is the shared control, pre-painted from the feed tally', () => {
+  const V = bootControl(async () => { throw new Error('a pre-painted row must not read'); });
+  const html = V.taskHtml({ id: 41, status: 'shipped', net_votes: 3, my_vote: -1 });
+  assert.match(html, /data-vote-kind="task"/);
+  assert.match(html, /data-vote-ready="1"/, 'no batched read for a row that carries its tally');
+  assert.match(html, /data-vote-net>\+3</);
+  assert.match(html, /vote__btn--down is-active" data-vote="-1" aria-pressed="true"/);
+  assert.match(html, /data-vote="1" aria-pressed="false"/);
+  assert.match(builders, /acclaimCanVote && window\.OTBVote\s*\? window\.OTBVote\.taskHtml\(t\)/);
+});
+
+test('a vote through the real control lands in the held, paged rows', async () => {
+  const V = bootControl(async () => ({ ok: true, json: async () => ({ ok: true, net_votes: 5, my_vote: 1 }) }));
+  const feed = feedHandler([{ id: 41, net_votes: 3, my_vote: null }, { id: 42, net_votes: 1, my_vote: null }]);
+  const table = el();
+  table.addEventListener('otb-vote', (ev) => feed.onAcclaimVote(ev));
+  const ctl = table.append(el({ 'data-vote-kind': 'task', 'data-vote-id': '41' }));
+  const up = ctl.append(el({ 'data-vote': '1' }));
+  ctl.append(el({ 'data-vote-net': '' }));
+  ctl.append(el({ 'data-vote': '-1' }));
+  await V.cast(up);
+  assert.equal(ctl.children[1].textContent, '+5', 'the row repaints in place');
+  const held = JSON.parse(JSON.stringify(feed.acclaimState.tasks));
+  assert.deepEqual(held, [{ id: 41, net_votes: 5, my_vote: 1 }, { id: 42, net_votes: 1, my_vote: null }]);
+  assert.match(builders, /addEventListener\('otb-vote', onAcclaimVote\)/, 'the feed listens for it');
+});
+
+test('the old vote markup, handler and CSS are gone', () => {
+  assert.doesNotMatch(builders, /acclaim__btn|acclaim__vote|data-vote-task|onAcclaimClick|data-acclaim-net/);
+  assert.doesNotMatch(read('style.css'), /\.acclaim__(btn|vote|readonly|net)/);
+  assert.match(read('hall-widgets.js'), /<th>Work<\/th><th>By<\/th><th>Votes<\/th><\/tr>/);
+});

package/tests/hall_asset_cache.mjs

@@ -0,0 +1,127 @@
+// tests/hall_asset_cache.mjs — task 1004855: the hall's fingerprinted files are
+// cached for a year; everything else keeps the one-minute lifetime.
+//
+// Every hall page is served from an in-memory copy whose local css/js links carry
+// ?v=<content hash> (src/asset-version.js, stamped once at boot). Those URLs can
+// never point at different bytes, so the browser may keep them for good instead of
+// re-checking ~26 files a minute after every page view. The long cache is only
+// sent when the ?v= matches the file's CURRENT hash: a page fetched just before a
+// deploy, a hand-typed ?v=, or a bare URL all keep the short lifetime, so a
+// changed hall file is still picked up on the next page load.
+//
+// serve-internal is DB-free (the pg pool connects lazily), so the real hall
+// handler is mounted on a throwaway express app and hit over loopback — the
+// tests/docs_openapi_route.mjs pattern.
+//
+// Run:  node --test tests/hall_asset_cache.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const { hashFile } = require('../src/asset-version.js');
+
+const LONG = 'public, max-age=31536000, immutable';
+const SHORT = 'public, max-age=60';
+
+// GET over loopback as the hall's own host (builders.<apex>): on the apex,
+// /builders/* is a 301 to the subdomain, so the request must name that host.
+function get(base, urlPath) {
+  const { port } = new URL(base);
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, path: urlPath, method: 'GET', headers: { host: 'builders.example.test' } },
+      (res) => {
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', (c) => { body += c; });
+        res.on('end', () => resolve({ status: res.statusCode, cache: res.headers['cache-control'], body }));
+      },
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+// The stamped links the served hall index page actually carries.
+async function stampedLinks(base) {
+  const res = await get(base, '/');
+  assert.equal(res.status, 200);
+  const html = res.body;
+  return [...html.matchAll(/\b(?:href|src)="(\/builders\/[^"?#]+\.(?:css|js))\?v=([0-9a-f]{12})"/g)]
+    .map((m) => ({ url: `${m[1]}?v=${m[2]}`, bare: m[1], v: m[2] }));
+}
+
+test('a hall HTML page keeps the one-minute cache', async () => {
+  await withServer(async (base) => {
+    const res = await get(base, '/');
+    assert.equal(res.status, 200);
+    assert.match(res.body, /<html/i);
+    assert.equal(res.cache, SHORT);
+  });
+});
+
+test('every stamped js/css link on the hall page is cached for a year', async () => {
+  await withServer(async (base) => {
+    const links = await stampedLinks(base);
+    assert.ok(links.some((l) => l.bare.endsWith('.js')), 'the index page stamps at least one script');
+    assert.ok(links.some((l) => l.bare.endsWith('.css')), 'the index page stamps at least one stylesheet');
+    for (const l of links) {
+      const res = await get(base, l.url.replace(/^\/builders/, ''));
+      assert.equal(res.status, 200, l.url);
+      assert.equal(res.cache, LONG, `${l.url} carries its content hash`);
+    }
+  });
+});
+
+test('the same file without a fingerprint keeps the short cache', async () => {
+  await withServer(async (base) => {
+    const res = await get(base, '/builders.js');
+    assert.equal(res.status, 200);
+    assert.equal(res.cache, SHORT);
+    const css = await get(base, '/style.css');
+    assert.equal(css.status, 200);
+    assert.equal(css.cache, SHORT, 'a bare stylesheet gets the same one-minute lifetime as a script');
+  });
+});
+
+for (const file of ['builders.js', 'style.css']) {
+  test(`${file}: a stale or made-up fingerprint keeps the short cache, so a changed file is picked up`, async () => {
+    const real = hashFile(path.join(HALL_DIR, file));
+    assert.ok(real, `${file} hashes`);
+    const stale = real === '000000000000' ? '111111111111' : '000000000000';
+    await withServer(async (base) => {
+      // A page fetched just before a deploy names the OLD hash; the server now holds
+      // new bytes, so those must not be pinned in the browser under that URL.
+      const res = await get(base, `/${file}?v=${stale}`);
+      assert.equal(res.status, 200);
+      assert.equal(res.cache, SHORT);
+      const handTyped = await get(base, `/${file}?v=3`);
+      assert.equal(handTyped.cache, SHORT);
+      // ...and the current hash is the one that earns the long cache.
+      const good = await get(base, `/${file}?v=${real}`);
+      assert.equal(good.cache, LONG);
+    });
+  });
+}

package/tests/hall_audit.mjs

@@ -448,6 +448,11 @@ const LITERAL_EXEMPT = {
   // docs/design/mocks/tweak-mode/Main.dc.html, built 1:1. Glass over the night
   // studio in both modes, so its palette sits on the panel's own root.
   'approval-queue.css': 'the Approval queue\'s glass is the artboard\'s own palette (task 1004323, the pixel contract: night glass in both modes)',
+  // The welcome (tasks 1004785, 1004818): the scene is the owner's own painting of a circuit city,
+  // by day and by night, with motion laid over it in the painting's colours. The painting is the
+  // palette, in both hall themes. The sky precedent.
+  'welcome-boot.css': 'the welcome\'s scene is the owner\'s day and night paintings; its colours are theirs (task 1004818)',
+  'welcome-boot.js': 'the welcome lays lights, pulses and cars over the owner\'s paintings in their own colours (task 1004818)',
 };
 const COLOUR_PROPS = 'color|background|background-color|border|border-color|border-top-color|border-bottom-color|fill|stroke|outline|outline-color|box-shadow|text-shadow';
 const colourLiteralRe = () =>
@@ -649,3 +654,61 @@ test('--scrim is defined once and does NOT flip with the mode', () => {
   const copies = [...css.matchAll(new RegExp(SCRIM_VALUE.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'))];
   assert.equal(copies.length, 1, `${SCRIM_VALUE} appears only in the --scrim declaration`);
 });
+
+// ---- no page has a top block (task 1004836, owner 2026-10-23) ---------------
+//
+// The rail highlights the page and the top bar names it, so style.css hides
+// every `.page-head` but Home's greeting band. The head stays in the markup
+// only to carry the page's one <h1> for screen readers — so anything
+// focusable left in it would be a control a keyboard reaches and nobody sees.
+
+// Every `<div class="page-head …">…</div>` in a page, nesting-aware.
+function pageHeads(html) {
+  const out = [];
+  const open = /<div\s+class="page-head(?:\s[^"]*)?"[^>]*>/g;
+  let m;
+  while ((m = open.exec(html))) {
+    const tag = /<(\/?)div\b[^>]*>/g;
+    tag.lastIndex = m.index + m[0].length;
+    let depth = 1;
+    let t;
+    while (depth > 0 && (t = tag.exec(html))) depth += t[1] ? -1 : 1;
+    out.push(html.slice(m.index, t ? t.index + t[0].length : html.length));
+  }
+  return out;
+}
+const FOCUSABLE = /<(a|button|input|select|textarea|details|summary)\b|\btabindex=|\bcontenteditable\b/i;
+const focusableIn = (html) => pageHeads(html.replace(/<!--[\s\S]*?-->/g, ''))
+  .filter((head) => FOCUSABLE.test(head.replace(/^<div[^>]*>/, '')));
+
+test('style.css hides every page head except Home', () => {
+  const css = fs.readFileSync(path.join(HALL, 'style.css'), 'utf8');
+  const rule = css.match(/body:not\(\[data-page="home"\]\) \.page-head \{([^}]*)\}/);
+  assert.ok(rule, 'the hall-wide hide rule is present and excepts only Home');
+  for (const decl of ['position: absolute', 'width: 1px', 'height: 1px', 'overflow: hidden', 'clip-path: inset(50%)']) {
+    assert.ok(rule[1].includes(decl), `the hide rule keeps "${decl}" (visually hidden, still read)`);
+  }
+});
+
+test('no hidden page head holds anything focusable', () => {
+  const offenders = [];
+  let scanned = 0;
+  for (const f of pages()) {
+    if (f === 'index.html') continue; // Home's band is visible: its chip is the reference design
+    const html = read(f);
+    scanned += pageHeads(html).length;
+    if (focusableIn(html).length) offenders.push(f);
+  }
+  assert.ok(scanned >= 20, `the scan found the page heads (${scanned}) — an empty scan would pass vacuously`);
+  assert.deepEqual(offenders, [], 'move the control into the page body, where it belongs in the layout');
+});
+
+test('the page-head scan catches a planted control, nested or not, and ignores comments', () => {
+  const head = (inner) => `<main><div class="page-head page-head--board"><h1 class="page-head__h">X</h1>${inner}</div><p>after</p></main>`;
+  assert.equal(focusableIn(head('<p class="page-head__sub">plain</p>')).length, 0);
+  assert.equal(focusableIn(head('<!-- a <button> once lived here -->')).length, 0);
+  assert.equal(focusableIn(head('<div class="x"><div><a href="/y">y</a></div></div>')).length, 1);
+  assert.equal(focusableIn(head('<span tabindex="0">z</span>')).length, 1);
+  // A control AFTER the head closes is the page body, not the head.
+  assert.equal(focusableIn(head('<div></div>') + '<button>ok</button>').length, 0);
+});

package/tests/hall_board_world.mjs

@@ -596,3 +596,23 @@ test('the Goal filter offers goals that only have BACKLOG work', () => {
   assert.match(populate, /\[\.\.\.taskState\.all, \.\.\.\(taskState\.backlog \|\| \[\]\)\]/,
     'built from the claimable feed alone, a backlog-only goal was unofferable');
 });
+
+// task 1004831: a session the server refuses (/me → 403) used to leave the hall
+// blank with only its sidebar. boot() now routes that to a card that says why.
+test('RUN: a refused session renders the explanatory card with a sign-out, naming the admitter from rankLabel', () => {
+  const { api, el } = bootHallRender({ me: ME });
+  api.renderSessionRefused('builder_inactive');
+  const html = el('landing-root').innerHTML;
+  assert.equal(el('landing-root').hidden, false);
+  assert.match(html, /switched off/);
+  assert.match(html, /ask the archon to switch it back on/, 'the admitter comes from ctx.rankLabel, not a hardcoded word');
+  assert.match(html, /id="refused-signout"/);
+  api.renderSessionRefused('session_scope');
+  assert.match(el('landing-root').innerHTML, /no longer accepted/, 'any other refusal gets the generic sentence');
+});
+
+test('builders.js: a 403 on /me reaches renderSessionRefused with its code', () => {
+  const buildersJs = read('builders.js');
+  assert.match(buildersJs, /err\.status = res\.status;/, 'getJSON carries the status on its error');
+  assert.match(buildersJs, /err\.status === 403\) \{ renderSessionRefused\(err\.code\); return; \}/, 'boot routes a refused /me to the card');
+});

package/tests/hall_city_card_words.mjs

@@ -0,0 +1,61 @@
+// tests/hall_city_card_words.mjs — the city's sign-off card speaks plain words
+// (owner screenshot 2026-10-24): a promise's markdown shows as readable text,
+// the force sign-off's answers carry no machine word, and nothing is cut mid-word.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const require = createRequire(import.meta.url);
+const life = require('../modules/lifecycle/governor-docket.js');
+
+function boot() {
+  const ctx = { console, document: {} };
+  ctx.window = ctx;
+  vm.createContext(ctx);
+  for (const f of ['street-deck.js', 'city-decide.js']) {
+    vm.runInContext(fs.readFileSync(path.join(PUB, f), 'utf8'), ctx);
+  }
+  return { Decide: ctx.window.GovCityDecide, Deck: ctx.window.GovDeck };
+}
+
+const MD = '**Every module is assessed automatically, and a human can override.** Bongos scores each module. Owner decision, 2026-09-10 under [#1003777](https://cloudbongos.com/builders#/task/1003777), see `config`.';
+
+test('markdown becomes plain words: bold marks, links and code marks are gone, line breaks stay', () => {
+  const { Deck } = boot();
+  assert.equal(Deck.plain(MD), 'Every module is assessed automatically, and a human can override. Bongos scores each module. Owner decision, 2026-09-10 under #1003777, see config.');
+  assert.equal(Deck.plain('# Heading\nline two'), 'Heading\nline two');
+  assert.equal(Deck.plain(null), '');
+});
+
+test('the card question is the first sentence of a long promise, and the whole text stays under Full text', () => {
+  const { Decide } = boot();
+  const q = Decide.questionOf(MD);
+  assert.equal(q, 'Every module is assessed automatically, and a human can override.');
+  assert.ok(!/\*\*|\]\(/.test(q));
+  assert.equal(Decide.questionOf('**Short.** one'), 'Short. one', 'a short promise is shown whole');
+  assert.match(Decide.questionOf('**Physics.** ' + 'The orb motion runs on the server as the one source of truth, '.repeat(3)), /^Physics\. The orb motion runs/, 'a bare headline takes the next sentence with it');
+  const long = 'x'.repeat(30) + (' word').repeat(60);
+  const cut = Decide.questionOf(long);
+  assert.ok(cut.length <= 140 && cut.endsWith('…') && !/\s…$/.test(cut), 'cut at a word with an ellipsis');
+  const full = Decide.fullText({ id: 'criteria_uat:1', title: MD }, { question: q });
+  assert.match(full, /Bongos scores each module\. Owner decision, 2026-09-10 under #1003777/);
+  assert.ok(!/\*\*|\]\(/.test(full));
+});
+
+test('the sign-off anyway answers read plainly, with no "force" in them', () => {
+  const m = life.uatMatter({ id: 9, criterion_md: MD, goal_id: 4, shipped_total: 1, backend_only: false }, { force: true });
+  const DeskSrc = fs.readFileSync(path.join(PUB, 'street-desk.js'), 'utf8');
+  assert.match(DeskSrc, /force: 'sign off anyway'/);
+  assert.ok(!/force:\s*'force'/.test(DeskSrc));
+  const reasons = m.acts.find((a) => a.key === 'force').options.map((o) => o.label);
+  assert.deepEqual(reasons, ['tested by hand', 'seen in review', 'no longer applies']);
+  const Desk = require(path.join(PUB, 'street-desk.js'));
+  assert.ok(reasons.every((l) => Desk.fitChip(l, Desk.LIMITS.chip) === l), 'each reason sits whole on a desk chip');
+  assert.equal(Desk.fitChip('no longer applies to this one at all', 24), 'no longer applies to…', 'a cut chip ends at a word, with an ellipsis');
+});