@bongos/core 1.21.5 → 1.21.6

package/tests/autonomy_config_idle.mjs

@@ -0,0 +1,272 @@
+// tests/autonomy_config_idle.mjs — idle on a setting is not idle on no work
+// (task 1004539).
+//
+// The incident: ten hours fenced with no_builder_scope while the hall said
+// "alive, waiting for work". These pin the done-when: runner health reports a
+// configuration idle as NOT ok with the fix, the owner's kill switch does not,
+// and the Discord notice is said once per change rather than once per loop.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ci = require('../modules/autonomy/config-idle.js');
+const { describeRunner } = require('../modules/autonomy/runner-health.js');
+const runner = require('../scripts/gds/autobongos-run.js');
+
+const NOW = Date.parse('2026-10-02T09:47:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const hb = (over = {}) => ({ host: 'winbox', mode: 'full', last_seen_at: agoS(30), ...over });
+
+// ── runner health: the hall's verdict ───────────────────────────────────────
+
+test('a runner idle on no_builder_scope is NOT ok, and the hall gets the fix', () => {
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope' }), { nowMs: NOW });
+  assert.equal(d.state, 'idle_config');
+  assert.equal(d.ok, false, 'the incident: this read ok=true for ten hours');
+  assert.equal(d.idleCode, 'no_builder_scope');
+  assert.match(d.remedy, /Settings/);
+  assert.match(d.detail, /no goals are picked/);
+  assert.match(d.detail, /winbox/);
+});
+
+test('every configuration code reads not-ok with its own remedy', () => {
+  for (const code of Object.keys(ci.CONFIG_IDLE)) {
+    const d = describeRunner(hb({ last_event: `config_idle:${code}` }), { nowMs: NOW });
+    assert.equal(d.ok, false, code);
+    assert.equal(d.remedy, ci.CONFIG_IDLE[code].remedy, code);
+  }
+});
+
+test('a config-idle runner that goes quiet past the dead line is DEAD, not idle', () => {
+  // A dead runner cannot report its configuration; silence still wins.
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope', last_seen_at: agoS(3 * 3600) }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+});
+
+test('the kill switch, a plain wait and an unknown code stay ok', () => {
+  for (const last_event of ['fenced', 'waiting', 'nothing_claimable', 'hold', 'config_idle:kill_switch', 'config_idle:<b>x</b>']) {
+    const d = describeRunner(hb({ last_event }), { nowMs: NOW });
+    assert.equal(d.state, 'alive', last_event);
+    assert.equal(d.ok, true, last_event);
+    assert.equal(d.remedy, undefined, last_event);
+  }
+});
+
+// ── the runner side: which rows count, and the grace ────────────────────────
+
+test('configIdleCode: configuration refusals count; deliberate stops and no-work do not', () => {
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_builder_scope' }), 'no_builder_scope');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_allowlist' }), 'no_allowlist');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'fence_unreadable' }), 'fence_unreadable');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', refused_goals: [7] }), 'goal_not_allowlisted');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', task_id: 5 }), null, 'one task outside the allowlist is the fence working');
+  assert.equal(ci.configIdleCode({ event: 'hold', unknown: true, reason: 'no gauge file' }), 'gauge_unknown');
+  for (const row of [
+    { event: 'fenced', code: 'kill_switch' },
+    { event: 'fenced', code: 'builder_paused' },
+    { event: 'fenced', code: 'not_permitted' },
+    { event: 'fenced', code: 'protected_path', task_id: 3 },
+    { event: 'hold', unknown: false, sleep_until: 1 },
+    { event: 'hold', unknown: false, usage_limit: true },
+    { event: 'nothing_claimable' },
+    null,
+  ]) assert.equal(ci.configIdleCode(row), null, JSON.stringify(row));
+});
+
+test('the grace: nothing is said until the stretch has held for it', () => {
+  const t0 = NOW;
+  let tr = ci.trackIdle(null, { event: 'fenced', code: 'no_builder_scope' }, t0);
+  assert.equal(ci.idleEvent(tr, t0 + (ci.GRACE_S - 1) * 1000), null);
+  tr = ci.trackIdle(tr, { event: 'fenced', code: 'no_builder_scope' }, t0 + 600_000);
+  assert.equal(tr.sinceMs, t0, 'the same code continues the stretch');
+  assert.equal(ci.idleEvent(tr, t0 + ci.GRACE_S * 1000), 'config_idle:no_builder_scope');
+  // A blip-prone code waits longer.
+  const fu = ci.trackIdle(null, { event: 'fenced', code: 'fence_unreadable' }, t0);
+  assert.equal(ci.idleEvent(fu, t0 + ci.GRACE_S * 1000), null);
+  assert.equal(ci.idleEvent(fu, t0 + ci.LONG_GRACE_S * 1000), 'config_idle:fence_unreadable');
+  // A different code restarts the clock; any other row ends it.
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'no_allowlist' }, t0 + 1).sinceMs, t0 + 1);
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'kill_switch' }, t0 + 1), null);
+  assert.equal(ci.trackIdle(tr, { event: 'nothing_claimable' }, t0 + 1), null);
+});
+
+test('markBeat leaves a working, booting or exiting beat alone', () => {
+  const tr = { code: 'no_builder_scope', sinceMs: NOW - 3600_000 };
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, tr, NOW).last_event, 'config_idle:no_builder_scope');
+  assert.equal(ci.markBeat({ last_event: 'loop', mode: 'full' }, tr, NOW).mode, 'full');
+  assert.equal(ci.markBeat({ last_event: 'worked', working_task_id: 9 }, tr, NOW).last_event, 'worked');
+  assert.equal(ci.markBeat({ last_event: 'boot' }, tr, NOW).last_event, 'boot');
+  assert.equal(ci.markBeat({ last_event: 'upgrade_exit' }, tr, NOW).last_event, 'upgrade_exit');
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, null, NOW).last_event, 'waiting');
+});
+
+test('THE LOOP: a runner fenced on no_builder_scope says so on its heartbeat once the grace has passed', async () => {
+  // Driven through the real forever(), so the beat override is wired, not just written.
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'no_builder_scope', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 10 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r,
+    emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false,
+    loadedHead: async () => null,
+    now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.equal(beats[0], 'boot');
+  // The first loop is inside the grace: pending, which the hall reads as a fence wait.
+  assert.equal(beats[1], 'loop');
+  assert.equal(beats[2], 'config_pending:no_builder_scope');
+  assert.equal(describeRunner(hb({ last_event: beats[2] }), { nowMs: NOW }).ok, true, 'inside the grace is not an alert');
+  assert.ok(beats.includes('config_idle:no_builder_scope'), `beats: ${beats.join(',')}`);
+  assert.equal(beats[beats.length - 1], 'config_idle:no_builder_scope', 'and keeps saying it while it holds');
+});
+
+test('THE LOOP: the kill switch never turns into a config_idle beat', async () => {
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'kill_switch', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 60 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r, emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false, loadedHead: async () => null, now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.ok(!beats.some((b) => String(b).startsWith('config_idle:')), beats.join(','));
+});
+
+// ── the notice: once per change ─────────────────────────────────────────────
+
+test('the Discord notice is DE-DUPLICATED: once when it starts, once when it clears', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  const beat = (lastEvent, extra = {}) => n.observe({ builderId: '3', host: 'WinBox', lastEvent, ...extra });
+
+  await beat('waiting');
+  assert.equal(posts.length, 0, 'quiet idle says nothing');
+  for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+  // A runner restart mid-stretch: boot, then the same setting pending again.
+  for (const e of ['loop', 'waiting', 'upgrade_exit', 'boot', 'loop', 'config_pending:no_builder_scope', 'waiting']) await beat(e);
+  await beat('config_idle:no_builder_scope');
+  assert.equal(posts.length, 1, 'thirty beats and a restart are one notice');
+  assert.match(posts[0].text, /no goals are picked/);
+  assert.match(posts[0].text, /Settings/);
+  assert.equal(posts[0].channel, 'ship_news');
+
+  await beat('config_idle:no_allowlist');
+  assert.equal(posts.length, 2, 'a different cause is a new notice');
+  await beat('nothing_claimable');
+  assert.equal(posts.length, 3, 'clearing is said once');
+  assert.match(posts[2].text, /no longer held/);
+  assert.match(posts[2].text, /no goal is allowed/, 'the clear names the setting in words');
+  for (const p of posts) assert.doesNotMatch(p.text, /no_allowlist|no_builder_scope/, 'never a raw code in a sentence a person reads');
+  await beat('nothing_claimable');
+  await beat('waiting');
+  assert.equal(posts.length, 3);
+});
+
+test('the kill switch never posts, and a working beat clears a notice', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'fenced' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:kill_switch' });
+  assert.equal(posts.length, 0);
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'loop', workingTaskId: 42 });
+  assert.equal(posts.length, 2);
+  // Separate runners are separate notices.
+  await n.observe({ builderId: 1, host: 'b', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 2, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  assert.equal(posts.length, 4);
+});
+
+test('a gauge notice clears when the runner moves to an ordinary capacity hold, or the owner throws the switch', async () => {
+  for (const after of ['hold', 'fenced']) {
+    const posts = [];
+    const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'waiting' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: after });
+    assert.equal(posts.length, 2, after);
+    assert.match(posts[1].text, /no longer held/, after);
+  }
+});
+
+test('the host lands in Discord as plain code, never a link or formatting', () => {
+  const t = ci.noticeText({ action: 'raise', code: 'no_allowlist', host: '[click](https://evil.example)*@everyone*' });
+  assert.doesNotMatch(t, /\]\(|https?:|\*|@/);
+  assert.match(t, /on `clickhttpsevil\.exampleeveryone`/);
+});
+
+test('no Discord on the instance: nothing posts and nothing is remembered', async () => {
+  const n = ci.createNotifier({ post: null });
+  const r = await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.deepEqual([r.posted, r.reason], [false, 'no_discord']);
+  assert.equal(n.notified.size, 0);
+  // A port that answers "no webhook for that channel" is the same.
+  const m = ci.createNotifier({ post: async () => ({ posted: false, reason: 'no_webhook_for_channel' }) });
+  await m.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.equal(m.notified.size, 0);
+});
+
+test('the hall draws idle_config as a warning with the fix, on the Gate page and in Settings', () => {
+  const fs = require('node:fs');
+  const gate = fs.readFileSync('modules/hall-ui/public/gate.js', 'utf8');
+  assert.match(gate, /idle_config: 'warn'/, 'the dot is a warning, not ok');
+  assert.match(gate, /h\.state === 'idle_config'[\s\S]{0,200}h\.remedy/, 'the checklist carries the remedy');
+  const panel = fs.readFileSync('modules/hall-ui/public/settings-autobongos.js', 'utf8');
+  assert.match(panel, /'GET', `\$\{API\}\/autonomy\/runners`/);
+  assert.match(panel, /h\.state !== 'idle_config'/);
+  assert.match(panel, /escapeHtml\(h\.remedy/);
+});
+
+// ── the route: POST /autonomy/heartbeat posts through the discord.post port ──
+
+test('POST /autonomy/heartbeat: thirty config-idle beats are ONE Discord post', async () => {
+  const path = require('node:path');
+  const express = require('express');
+  const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+  const api = require('../src/module-api.js');
+  const saved = { b: api.requireBuilder, p: api.requirePermission, r: api.resolveOptional, q: api.pool.query };
+  const posts = [];
+  api.requireBuilder = (r, _s, next) => { r.builder = { id: 7, rank: 'metic' }; next(); };
+  api.requirePermission = () => (_r, _s, next) => next();
+  api.resolveOptional = (name, dflt) => (name === 'discord.post' ? async (m) => { posts.push(m); return { posted: true }; } : dflt);
+  api.pool.query = async () => ({ rows: [{ host: 'winbox' }] });
+  const routePath = require.resolve(path.resolve('modules/autonomy/routes/autonomy.js'));
+  delete require.cache[routePath];
+  let server;
+  try {
+    const router = require(routePath)();
+    const app = express();
+    app.use(express.json()); app.use(attachFail); app.use(router);
+    server = app.listen(0);
+    await new Promise((r) => server.once('listening', r));
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const beat = async (last_event) => {
+      const r = await fetch(`${base}/autonomy/heartbeat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ host: 'WinBox', last_event }) });
+      assert.equal(r.status, 200);
+      await new Promise((res) => setImmediate(res));
+    };
+    await beat('fenced');
+    for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+    await beat('waiting');
+    await beat('config_idle:no_builder_scope');
+    assert.equal(posts.length, 1);
+    assert.match(posts[0].text, /`WinBox`/);
+    assert.match(posts[0].text, /Settings/);
+  } finally {
+    if (server) server.close();
+    api.requireBuilder = saved.b; api.requirePermission = saved.p; api.resolveOptional = saved.r; api.pool.query = saved.q;
+    delete require.cache[routePath];
+  }
+});

package/tests/core_update_banner.mjs

@@ -398,3 +398,32 @@ test('a trailing slash is still /deploy', async () => {
   await new Promise((r) => setTimeout(r, 0));
   assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
 });
+
+test('the banner asks with the project\'s stored update rule (task 1004535)', async () => {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const savedBuilder = realAuth.requireBuilder;
+  const savedPerm = realAuth.requirePermission;
+  realAuth.requireBuilder = (_req, _res, next) => next();
+  realAuth.requirePermission = () => (_req, _res, next) => next();
+  delete r2.cache[routePath];
+  let seen;
+  const express = r2('express');
+  const app = express();
+  app.use(r2(routePath)({ coreUpdate: async (a) => { seen = a; return { reading: 'ok', behind: true, channel: a.channel }; }, selfChannel: async () => 'minor' }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/core-update`);
+    assert.equal(res.status, 200);
+    assert.equal(seen.channel, 'minor', 'the rule set on /deploy, not the platform default');
+    assert.equal((await res.json()).update.channel_source, 'deploy');
+  } finally {
+    server.close();
+    realAuth.requireBuilder = savedBuilder;
+    realAuth.requirePermission = savedPerm;
+    delete r2.cache[routePath];
+  }
+});

package/tests/core_upgrade_door.mjs

@@ -866,10 +866,25 @@ await t('a box that reached the target by another road supersedes the failure',
 
 await t('AN UNREADABLE REGISTRY LEAVES A FAILURE STANDING — not knowing is not evidence of recovery', () => {
   const now = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x' };
-  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, recommended: null }, null, now);
+  // An unreadable registry is what the snapshot writer stores when `npm view` fails: an
+  // EMPTY available list, and so no recommendation (provision-core-upgrade.js snapshotCoreVersions).
+  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, available: [], recommended: null }, null, now);
   assert.equal(p.last_move.superseded, false, 'the direction to fail in is showing an old failure, never hiding a live one');
 });
 
+await t('an UP-TO-DATE box supersedes an old failure: a read registry with nothing on offer is not "unknown" (task 1004534)', () => {
+  // The live shape, 2026-10-02: cloudbongos served 1.21.5, the registry answered (1168
+  // versions), nothing newer was within its rule, and the page still led with a day-old
+  // "waiting on a decision" about 1.20.73. recommended=null was being read as "the
+  // registry could not be read", so the failure could never become history.
+  const old = { action: 'core-upgrade', state: 'error', target_version: '1.20.73', resolved_at: new Date().toISOString(), last_error: 'x', failure_class: 'needs_decision', failure_reason: 'outside_channel' };
+  const p = CU.previewFromSnapshot(ACTIVE, { served_version: '1.21.5', available: ['1.20.73', '1.21.5'], recommended: null, observed_at: new Date().toISOString() }, null, old);
+  assert.equal(p.behind, false);
+  assert.equal(p.last_move.superseded, true, 'the box is current; a failure about another version is history');
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, true), true);
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, false), false, 'an unread registry still leaves it standing');
+});
+
 await t('lastMoveSuperseded computes no version ORDERING — only identity', () => {
   // The page's standing rule is that no version comparison happens outside the runner's
   // channel resolution. This helper answers "is this news" without ever asking which of
@@ -885,6 +900,21 @@ await t('lastMoveSuperseded computes no version ORDERING — only identity', ()
   assert.equal(CU.lastMoveSuperseded('1.19.921', '1.19.900', '1.19.949'), true);
 });
 
+console.log('\nthe platform\'s own rule, for Settings and the banner (task 1004535):');
+
+await t('selfUpdateChannel reads the CONTROL-PLANE row\'s rule', async () => {
+  const sqls = [];
+  const db = { query: async (sql) => { sqls.push(sql); return { rows: [{ update_channel: 'minor' }] }; } };
+  assert.equal(await CU.selfUpdateChannel(db), 'minor');
+  assert.match(sqls[0], /hosting_shape = 'control-plane'/, 'this hall\'s own row, never a tenant\'s');
+});
+
+await t('selfUpdateChannel answers null with no row, an unknown value, or a failed read', async () => {
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [{ update_channel: 'nightly' }] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => { throw new Error('relation does not exist'); } }), null);
+});
+
 console.log('\nthe project\'s update rule (task 1004445):');
 
 const channelHandler = (inst, calls) => updateChannelHandlerFor({

package/tests/core_upgrade_runner.mjs

@@ -232,6 +232,26 @@ await t('the channel refusal names a step that EXISTS on /deploy, never "change
   assert.match(major, /upgrading-the-core\.md/);
 });
 
+await t('a target the box ALREADY SERVES is not a channel refusal — the move is a no-op (task 1004534)', () => {
+  // 2026-10-01 16:32: the sweep and the door both went for 1.20.73; the sweep got there
+  // first, and the door's press was refused as "outside this project's 'minor' update
+  // channel … across a major version or onto a prerelease" — false on every count.
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  assert.equal(R.targetFault('1.20.73', ['1.20.72', '1.20.73'], '1.20.73', 'minor', channelAllows, compare), null,
+    'no fault: the runner\'s own already-serving check answers it as a no-op');
+});
+
+await t('a target BELOW what the box serves says so, and is never called outside the update rule (task 1004534)', () => {
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const f = R.targetFault('1.20.73', ['1.20.73', '1.21.5'], '1.21.5', 'minor', channelAllows, compare);
+  assert.ok(f, 'still refused — a move never goes backwards on its own');
+  assert.doesNotMatch(f, /update channel|major version|prerelease/, 'none of the channel sentence is true here');
+  assert.match(f, /already runs core 1\.21\.5/);
+  assert.equal(require('../scripts/gds/upgrade-outcome.js').runnerReason(f), 'downgrade');
+});
+
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
   const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
   assert.match(empty, /could not read the published core versions/);

package/tests/hall_audit.mjs

@@ -369,7 +369,16 @@ test('the module doc still records where the 2179 density pass landed', () => {
 // /thinking left this list in task 1004327 (owner decision 2026-09-27): it sits
 // in the hall chrome now, with the shell's full-screen switch to hide it. The
 // project sky (/goal-map) followed in task 1004430, so the list is empty again.
-const STANDALONE_EXEMPT = {};
+// THE GOVERNOR CITY's home (task 1004524, goal 1000125) is on it now, for the
+// reason the sky first was: the task and its reference design
+// (docs/design/mocks/governor-city/Street.dc.html, the home view) say nothing
+// else is on the page but the wordmark, a sun/moon switch, start governing and
+// one line. It still loads style.css (the hall's tokens, so no private palette:
+// city.css spends var(--bg), var(--ink), var(--accent) …), and reads and writes
+// the hall's own 'hall-theme' preference. Whether it should join the chrome
+// behind the full-screen switch, as the sky did in task 1004327, is the
+// owner's call, named in that task's ship notes.
+const STANDALONE_EXEMPT = { 'city.html': 'the governor city home: nothing on the page but the prototype home (task 1004524)' };
 
 test('every hall page loads style.css and shell.js', () => {
   const missing = [];